What the vulnerability does
01Description
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter.
Note: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead.
Explanation of Vulnerability in Simple Terms
02Summary
Fluent Forms Pro Add On Pack versions up to 6.1.17 lack proper authorization checks, allowing unauthenticated attackers to modify form data and disrupt service. The vulnerability requires no user interaction and is exploitable over the network. Site administrators should update to a version newer than 6.1.17 as soon as available.
What an attacker can do
03Attacker Capabilities
Modify form submissions and cause service disruption without authentication.
Potential impact on your site
04Site Impact
Form data integrity compromised; attackers can alter submissions and cause downtime.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 5, 2026
CVE published
April 8, 2026
Record updated
