What the vulnerability does
01Description
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the exportEntries function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Fluent Forms manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.
Explanation of Vulnerability in Simple Terms
02Summary
Fluent Forms through version 6.2.0 contains an authorization flaw that allows unauthenticated attackers to read sensitive data over the network. The vulnerability requires no user interaction and affects the confidentiality of form data. Site administrators should update immediately to a version newer than 6.2.0.
What an attacker can do
03Attacker Capabilities
Read sensitive form data and user information without logging in.
Potential impact on your site
04Site Impact
Form submissions and user data may be exposed to unauthorized access without warning.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
