The Fluent Forms Pro Add On Pack plugin for WordPress contains an authorization flaw that permits any unauthenticated user to invoke the deleteFile() routine through a public AJAX endpoint. Because the routine lacks nonce verification and capability checks, an attacker can supply an attachment_id and have the system permanently remove the corresponding media file from the WordPress library. This deletion ability threatens site integrity by erasing images, documents, or other media assets that administrators or users rely on.

All installations of techjewel’s Fluent Forms Pro Add On Pack up to and including version 6.1.17 are affected. The vulnerability originates in the Uploader class and is triggered via the public Ajax action registered by addPublicAjaxAction(). Administrators who have not upgraded their plugin to a version newer than 6.1.17 remain at risk.

With a CVSS score of 6.5 the vulnerability is classified as moderate, and the current EPSS estimate is below 1 %, indicating that real-world exploitation is unlikely at present. Nevertheless, the flaw is exploitable over the network by anyone with access to the site, and it requires only knowledge of an attachment ID, which can be discovered through normal media library queries or the WordPress REST API. As the flaw is not listed in the CISA KEV catalog, no immediate incident response measures are mandated, but the lack of authentication and authorisation makes it a priority for patching.