What’s Vulnerable › Vulnerabilities
CVE-2026-11578: Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-02 · updated 2026-07-02
Description
The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.
Affected products
- Fluent Forms: before 6.2.5 — fixed in 6.2.5
How to fix
Upgrade to a fixed version: Fluent Forms 6.2.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-11578 or the next vulnerability affects your stack