This vulnerability exists because the plugin fails to enforce proper authorization checks, allowing users with incorrectly configured access levels to perform privileged actions. An attacker who can execute requests against the affected plugin endpoints may be able to create, edit, or delete forms and submit arbitrary data. The impact is the unauthorized modification or removal of form content and potentially the exposure of sensitive user input stored in the database.

The flaw affects the WP ManageNinja LLC FluentForm plugin for WordPress, specifically all versions up to and including 6.2.15. The plugin can be installed on any WordPress website that deploys FluentForm, so any site using an affected version is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through authenticated web requests to the plugin’s administrative endpoints; the required preconditions are a user account with a misconfigured role or capability. Because no exploitation code is publicly disclosed, the risk of exploitation is not immediately high, but an attacker who gains access to an account with elevated (but incorrectly restricted) privileges could easily exploit the flaw.