Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Embedded Post Author Smartcodes
- ID
- WPSEC-2026-0183
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.14
- Remediation
- Update to 6.2.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the {embed_post.author.*} and {embed_post.*} smartcodes in all versions up to, and including, 6.2.13. This is due to the smartcode parser resolving any author property or user meta key, including the password hash, the password reset key and protected meta such as two-factor secrets, as well as a post's password, for a post whose ID is taken from the submitted form data. This makes it possible for authenticated attackers who have been granted Fluent Forms form-management access by an administrator to place such a smartcode in a form's confirmation message and read these values for the author of any post, including administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-0183/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.14/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS