A missing authorization flaw in the WordPress FluentForm plugin allows an attacker to perform actions that should be restricted to higher‑privileged users, effectively granting elevated privileges. The vulnerability is a classic example of broken access control (CWE‑862) and could enable unauthorized creation, editing, or deletion of forms and their data, compromising data confidentiality and integrity.

WordPress plugin FluentForm from WP ManageNinja LLC is affected in all releases up to and including version 6.2.16. Versions from 6.2.17 onward contain the fix, so any site using 6.2.16 or earlier is vulnerable.

The CVSS score of 6.5 classifies the risk as medium. The likely attack vector is interacting with the plugin’s administrative interface; an attacker with access to the WordPress backend could manipulate form data by leveraging the missing authorization checks. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to reach the plugin’s administration pages and bypass the authorization controls, which is typically straightforward for users who can reach those pages.