CVE-2026-6344: Fluent Forms Path Traversal Vulnerability

CVE-2026-6344 Overview

CVE-2026-6344 is a path traversal vulnerability [CWE-22] in the Fluent Forms plugin for WordPress, affecting all versions up to and including 6.2.1. The flaw resides in the getAttachments() method of EmailNotificationActions, which resolves attacker-supplied file-upload URLs into filesystem paths without proper containment validation. Authenticated attackers with administrator access can read arbitrary files accessible to the web-server user, including wp-config.php containing database credentials and authentication salts. The resolved file is silently attached to outbound admin notification emails sent via wp_mail().

Critical Impact
Authenticated administrators can exfiltrate sensitive server files such as wp-config.php, exposing database credentials and WordPress authentication salts.

Affected Products

Fluent Forms plugin for WordPress, versions up to and including 6.2.1
WordPress sites with admin-notification email actions configured to attach file-upload fields
Hosting environments where the web-server user can read sensitive configuration files

Discovery Timeline

2026-05-06 - CVE-2026-6344 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-6344

Vulnerability Analysis

The vulnerability stems from insufficient path validation when Fluent Forms processes file-upload field values during email notification dispatch. The getAttachments() method receives a URL submitted with a form, attempts to confirm it points inside the WordPress uploads directory, and then converts it to a filesystem path. The validation logic relies on a strpos() prefix check against the raw URL, wp_normalize_path() for path canonicalization, and file_exists() for existence verification.

None of these primitives reject directory traversal sequences. strpos() only confirms that the uploads base URL appears as a prefix and does not detect ..\..\ segments appended afterward. wp_normalize_path() converts backslashes to forward slashes but does not collapse ../ traversal segments. The kernel resolves the resulting path when file_exists() is called, allowing access to files outside the uploads directory. The resolved file is then attached to the admin notification email.

Root Cause

The root cause is reliance on string-prefix matching instead of canonical-path containment checks. A correct implementation would resolve the path with realpath() and verify the result remains inside the uploads directory. The patched version (WordPress changeset #3513845) replaces the flawed validation in EmailNotificationActions.php with stricter path containment logic.

Attack Vector

An authenticated administrator configures a form whose admin notification action attaches a file-upload field. The attacker submits the form with a crafted URL of the form <upload_baseurl>/../../<target> as the file-field value. The getAttachments() routine prefix-matches the upload base URL, normalizes path separators, and resolves the traversal at the filesystem layer. The targeted file, such as /var/www/html/wp-config.php, is attached to the outbound email and delivered to the configured admin recipient. The email recipient is not attacker-controlled, which limits direct exfiltration, but an administrator who configures their own notification address effectively reads any file the web-server user can access.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Email Notification Action source for technical details.

Detection Methods for CVE-2026-6344

Indicators of Compromise

Form submissions where file-upload field values contain ../ or ..\ traversal sequences targeting paths outside the WordPress uploads directory
Outbound wp_mail() notifications carrying attachments with names matching sensitive files such as wp-config.php, .env, or /etc/passwd
Admin-notification email rules recently modified to include file-upload field attachments combined with anomalous form submissions

Detection Strategies

Inspect web access logs for POST requests to Fluent Forms submission endpoints containing URL-encoded traversal patterns such as %2E%2E%2F in file-field parameters
Audit the wp_fluentform_submissions table for stored input values containing ../ sequences in file-upload columns
Correlate Fluent Forms admin notification configurations with outbound mail server logs to identify attachments resolving to non-uploads directories

Monitoring Recommendations

Enable WordPress activity logging on plugin and form configuration changes, particularly to EmailNotificationActions settings
Monitor file system access by the web-server user for reads against wp-config.php and other sensitive paths originating from PHP-FPM workers handling Fluent Forms requests
Alert on outbound SMTP messages from the WordPress host containing attachments that fall outside the wp-content/uploads directory

How to Mitigate CVE-2026-6344

Immediate Actions Required

Update the Fluent Forms plugin to the version that includes WordPress changeset #3513845 or later
Audit administrator accounts and remove unused or shared admin sessions; this vulnerability requires administrator-level authentication
Rotate WordPress authentication salts in wp-config.php and database credentials if compromise is suspected
Review all configured admin email notifications for unexpected file-upload attachments

Patch Information

The vendor addressed the issue in the Fluent Forms plugin source tree via changeset #3513845, which corrects the path validation in EmailNotificationActions.php. Site administrators should update the plugin through the WordPress dashboard to the fixed version above 6.2.1.

Workarounds

Temporarily remove or disable Fluent Forms admin notifications that attach file-upload fields until the patch is applied
Restrict the WordPress administrator role to a minimal set of trusted users and enforce multi-factor authentication on those accounts
Apply file system permissions so that the web-server user cannot read wp-config.php outside of normal WordPress bootstrap, where supported by the hosting configuration

bash

# Configuration example: tighten wp-config.php permissions
chown root:www-data /var/www/html/wp-config.php
chmod 640 /var/www/html/wp-config.php