The vulnerability in the Fluent Forms plugin allows an attacker with an authenticated user account that has Fluent Forms Manager access, but limited to a subset of forms, to bypass authorization checks by supplying a forged form_id in the request. The SubmissionPolicy class incorrectly authorizes submission-level actions (read, modify status, add notes, and permanently delete) based solely on the user-supplied form_id parameter. Consequently, the attacker can view, alter, annotate, and delete submissions that belong to any other form for which they are not authorized, leading to a breach of confidentiality and integrity of user data.

vulnerable systems are WordPress sites running the techjewel Fluent Forms plugin version 6.1.21 or earlier. Any site that has installed an affected release is at risk until it receives an update to 6.2.0 or later.

The CVSS score of 8.2 indicates a high severity. While EPSS information is not available, the lack of a KEV listing suggests no current large-scale exploitation reports, but the authenticated nature of the attack means that site administrators should not underestimate the risk. The attack vector, inferred from the description, is an authenticated POST or GET request that manipulates the form_id query parameter; no additional privileges or remote code execution required.