The vulnerability in Fluent Forms is an incorrect authorization flaw (CWE‑863) that allows authenticated users with subscriber-level rights or higher to cancel another user’s subscription by manipulating a subscription_id parameter in the payment cancellation AJAX endpoint. Because the plugin does not confirm that the requester owns the subscription, an attacker can terminate a subscriber’s recurring service without permission.

WordPress sites that have installed the wpmanageninja:Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin version 6.2.1 or older are affected. Sites that use the plugin’s subscription management feature are vulnerable until the plugin is updated to a version that implements proper ownership verification.

With a CVSS score of 5.4, the flaw is of moderate severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation has been reported. The attack requires an authenticated session and access to the subscription cancellation endpoint, so only users who are logged in with subscriber privileges or higher can exploit it. Because the flaw is limited to authorized users, there is no risk to unauthenticated visitors, but the impact to affected subscribers remains significant.