Vulnerabilities / Fluent Forms / WPSEC-2026-0004
Fluent Forms <= 6.2.14 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via User Search
Low 2.7
CWE-200Fixed in 6.2.15
- ID
- WPSEC-2026-0004
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.15
- Remediation
- Update to 6.2.15 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the user search AJAX handler in all versions up to, and including, 6.2.14 due to the handler only checking the Fluent Forms entries-management permission rather than the list_users capability. This makes it possible for authenticated attackers who were granted Fluent Forms entry-management access by an administrator to search and enumerate the site's WordPress users, including their email addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-0004/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.15/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS