Fluent Forms <= 6.2.13 - Authenticated (Fluent Forms Manager+) Sensitive Information Exposure via Global Settings Endpoint
- ID
- WPSEC-2026-0187
- Plugin
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (fluentform)
- Affected
- all versions before 6.2.14
- Remediation
- Update to 6.2.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Fluent Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via the global settings REST endpoint in all versions up to, and including, 6.2.13. This is due to the option-key allow-list accepting any fluentform-prefixed option, including the plugin's encryption key, the payment gateway settings and the integration credential options that the regular settings screens redact. This makes it possible for authenticated attackers who have been granted Fluent Forms settings-management access by an administrator to read the encryption key and the stored gateway and integration credentials, and decrypt secrets such as the Stripe secret key, unless the encryption key is defined in wp-config.php.
References
- https://wpsec.com/vuln/WPSEC-2026-0187/
- https://plugins.svn.wordpress.org/fluentform/tags/6.2.14/
- https://wordpress.org/plugins/fluentform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS