Missing authorization checks in the WP ManageNinja LLC Fluent Forms Pro Add On Pack plugin allow attackers to gain privileged access to administrative features. The flaw stems from incorrectly configured access control levels, which could enable users without sufficient privileges to perform restricted actions. This type of breach permits the attacker to compromise the integrity of forms and data handled by the plugin.

Fluent Forms Pro Add On Pack is affected for all versions up to and including 6.2.13. The plugin is distributed by WP ManageNinja LLC and installed via WordPress. Any site using these versions is potentially vulnerable.

The CVSS score of 5.3 indicates a medium impact, primarily affecting integrity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, as the plugin runs within a WordPress installation and can be manipulated over the web. A threat actor would need to authenticate with a role that has sufficient rights to access the plugin’s administrative interface and may exploit the missing enforcement to elevate privileges or alter form behavior.