CVE-2026-5395: Fluent Forms Auth Bypass Vulnerability

CVE-2026-5395 Overview

CVE-2026-5395 is an Insecure Direct Object Reference (IDOR) vulnerability in the Fluent Forms WordPress plugin. The flaw affects all versions up to and including 6.2.0. The plugin fails to validate a user-controlled key inside the exportEntries function. Authenticated attackers holding Fluent Forms manager-level access or above can bypass form-level access restrictions. They can read submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names through error message disclosure. The issue is tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key).

Critical Impact

Authenticated attackers with manager-level access can exfiltrate form submissions and arbitrary database table contents from affected WordPress installations.

Affected Products

• Fluent Forms WordPress plugin versions up to and including 6.2.0
• WordPress sites running the affected plugin with multiple managers
• The vulnerable code resides in app/Services/Transfer/TransferService.php

Discovery Timeline

• 2026-05-14 - CVE-2026-5395 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-5395

Vulnerability Analysis

The vulnerability resides in the exportEntries function of the Fluent Forms plugin. The function accepts a user-controlled key that identifies which form entries to export. The plugin does not verify whether the requesting user has permission to access the referenced object. This omission allows the supplied identifier to point to forms, tables, or records outside the requester's authorization scope.

Because Fluent Forms supports a manager role with delegated form access, the plugin must enforce per-form authorization checks on every export operation. The missing check converts a routine export endpoint into a data-exfiltration primitive. Error messages returned by the export routine further leak the names of database tables, enabling attackers to map the schema before extracting data.

Root Cause

The root cause is missing object-level authorization on a parameter consumed by exportEntries. The handler trusts the client-supplied key and passes it to the export logic without checking ownership or role-scoped permissions. This pattern matches [CWE-639], where access decisions rely on values that the attacker can modify.

Attack Vector

An attacker authenticates to WordPress with a Fluent Forms manager-level account or higher. The attacker then invokes the export action while substituting the controlled key with identifiers for forms or database tables outside their assigned scope. The server returns the requested submissions or table contents. Crafted invalid values trigger SQL or application errors that disclose table names, supporting further enumeration.

No verified exploit code is published. See the Wordfence Vulnerability Report and the WordPress Changeset Update for technical details on the fix.

Detection Methods for CVE-2026-5395

Indicators of Compromise

• Requests to Fluent Forms admin-ajax or REST endpoints invoking the export action from accounts with manager-level roles
• Unexpected CSV or JSON export downloads referencing form IDs or table identifiers outside the user's assigned forms
• WordPress error log entries from TransferService.php containing database table names or SQL errors
• Spikes in export volume from a single authenticated user within a short window

Detection Strategies

• Audit WordPress access logs for repeated calls to the Fluent Forms transfer or export endpoints with varying object identifiers
• Correlate authenticated session activity with the role of the requesting user and the form IDs being accessed
• Alert on responses returning large payloads from export actions to non-administrator accounts
• Review database query logs for SELECT statements originating from the plugin that reference tables outside the fluentform_* namespace

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized log platform and retain export-action events for at least 90 days
• Monitor creation of new manager-level Fluent Forms accounts and flag privilege changes for review
• Track outbound data transfer volume from the WordPress host to detect bulk submission exfiltration

How to Mitigate CVE-2026-5395

Immediate Actions Required

• Update the Fluent Forms plugin to a version newer than 6.2.0 that includes the fix from changeset 3507987
• Audit all WordPress accounts with Fluent Forms manager-level access and remove unnecessary privileges
• Review export and submission download activity for the past 90 days for signs of unauthorized access
• Rotate any credentials or sensitive data that may have been collected through Fluent Forms submissions

Patch Information

The vendor patched the issue in app/Services/Transfer/TransferService.php. Site administrators should apply the latest Fluent Forms release through the WordPress plugin updater. Reference the WordPress Changeset Update for the exact code changes that enforce form-level authorization on the export path.

Workarounds

• Restrict the Fluent Forms manager role to trusted administrators only until the patch is applied
• Place the WordPress admin area behind an IP allowlist or web application firewall rule that blocks unauthorized export requests
• Disable the Fluent Forms export and transfer functionality through role capability filters if immediate patching is not feasible

# Update Fluent Forms via WP-CLI to the patched release
wp plugin update fluentform
wp plugin get fluentform --field=version