CVE-2026-11578
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
The Fluent Forms WordPress plugin before version 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage. This allows a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms.
Risk Assessment
The risk involves potential data loss from forms that the Manager should not have access to, which could compromise data integrity and confidentiality within the organization.
Recommendation
It is recommended to immediately update the Fluent Forms plugin to version 6.2.5 or later, which fixes this vulnerability. Also review the Manager permission configuration to ensure they are properly restricted.
Original NVD description (English source)
The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.