CVE-2026-2899: Fluent Forms Pro Auth Bypass Vulnerability

CVE-2026-2899 Overview

The Fluent Forms Pro Add On Pack plugin for WordPress contains a Missing Authorization vulnerability (CWE-862) in all versions up to, and including, 6.1.17. This security flaw exists due to the deleteFile() method in the Uploader class lacking proper nonce verification and capability checks. The AJAX action is registered via addPublicAjaxAction() which creates both wp_ajax_ and wp_ajax_nopriv_ hooks, exposing the functionality to unauthenticated users.

This vulnerability allows unauthenticated attackers to delete arbitrary WordPress media attachments by manipulating the attachment_id parameter. While the researcher initially described file deletion via the path parameter using sanitize_file_name(), the actual vulnerable code path is through the attachment_id parameter, as path-based deletion uses Protector::decrypt() which prevents exploitation.

Critical Impact

Unauthenticated attackers can delete arbitrary WordPress media attachments, potentially causing data loss and site functionality disruption without requiring any authentication or user interaction.

Affected Products

• Fluent Forms Pro Add On Pack plugin for WordPress versions up to and including 6.1.17

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-2899 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-2899

Vulnerability Analysis

This vulnerability represents a critical authorization bypass affecting the WordPress plugin ecosystem. The core issue stems from improper implementation of access controls in the Uploader class's deleteFile() method. When WordPress plugins register AJAX handlers, they must implement both nonce verification (to prevent CSRF attacks) and capability checks (to ensure the user has appropriate permissions). In this case, the Fluent Forms Pro Add On Pack fails to implement either safeguard.

The use of addPublicAjaxAction() for registering the vulnerable handler is particularly dangerous as it creates both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) hooks. This design decision, combined with the missing authorization checks, transforms what should be an admin-only function into a publicly accessible attack surface.

Root Cause

The root cause of this vulnerability is the absence of proper authorization mechanisms in the deleteFile() method within the Uploader class. Specifically, the method fails to:

1. Verify a valid nonce token to prevent cross-site request forgery
2. Check user capabilities to ensure only authorized users can perform file deletion operations
3. Validate that the requesting user has appropriate ownership or permissions over the media attachment being deleted

The registration of this action via addPublicAjaxAction() exposes the endpoint to unauthenticated requests, compounding the authorization failure.

Attack Vector

The attack exploits the network-accessible AJAX endpoint that handles file deletion requests. An unauthenticated attacker can craft malicious HTTP requests to the WordPress AJAX handler, specifying arbitrary attachment_id values to delete media files from the target WordPress installation.

The attack flow involves:

1. Identifying a WordPress site running a vulnerable version of Fluent Forms Pro Add On Pack
2. Discovering valid attachment IDs through enumeration or information disclosure
3. Sending unauthenticated AJAX requests to the deleteFile endpoint with target attachment IDs
4. Successfully deleting media attachments without any authentication or authorization

Since the vulnerability does not require user interaction and is accessible over the network, attackers can automate mass deletion of media files, potentially disrupting site functionality by removing critical images, documents, or other media assets.

Detection Methods for CVE-2026-2899

Indicators of Compromise

• Unexpected HTTP POST requests to WordPress AJAX endpoints (/wp-admin/admin-ajax.php) with file deletion actions from unauthenticated sessions
• Sudden decrease in media library attachment count without corresponding administrative actions
• Web server access logs showing repeated AJAX calls with attachment_id parameters from external IP addresses
• Missing media files that were previously present without documented deletion by administrators

Detection Strategies

• Monitor WordPress AJAX endpoint logs for suspicious patterns of unauthenticated requests targeting file deletion functionality
• Implement web application firewall (WAF) rules to detect and block unusual attachment_id parameter manipulation
• Configure file integrity monitoring on the WordPress uploads directory to detect unauthorized media deletions
• Review plugin activity logs for deletion events that lack corresponding authenticated user sessions

Monitoring Recommendations

• Enable detailed WordPress access logging with user authentication status tracking
• Set up alerts for bulk media deletion events or rapid sequential attachment access
• Monitor for enumeration patterns in attachment_id requests that may indicate reconnaissance activity
• Deploy endpoint detection solutions capable of correlating web application events with file system changes

How to Mitigate CVE-2026-2899

Immediate Actions Required

• Update Fluent Forms Pro Add On Pack to a version newer than 6.1.17 that addresses this vulnerability
• Temporarily disable the Fluent Forms Pro Add On Pack plugin if an immediate update is not available
• Review media library for any unauthorized deletions and restore from backups if necessary
• Implement web application firewall rules to restrict unauthenticated access to AJAX file deletion endpoints

Patch Information

The vendor has released a security update addressing this Missing Authorization vulnerability. Administrators should consult the Fluent Forms Changelog for specific version information and update details. Additional technical details about this vulnerability are available in the Wordfence Vulnerability Report.

Workarounds

• Implement server-level access restrictions to block unauthenticated requests to the WordPress AJAX handler for sensitive actions
• Use a WordPress security plugin to add additional nonce and capability verification layers
• Configure .htaccess or nginx rules to restrict access to admin-ajax.php from trusted IP ranges only
• Consider temporarily replacing plugin functionality with alternative solutions until the patch can be applied

# Example: Restrict AJAX access via .htaccess (Apache)
# Add to WordPress root .htaccess file
<Files admin-ajax.php>
    # Allow authenticated admin access
    Order Deny,Allow
    Deny from all
    # Allow from specific trusted IPs
    Allow from 192.168.1.0/24
    # Allow WordPress to handle legitimate AJAX
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
        RewriteCond %{REQUEST_METHOD} POST
        RewriteRule ^admin-ajax\.php$ - [F,L]
    </IfModule>
</Files>