Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder

Wordfence Intelligence   >   Vulnerability Database   >   Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder
5.3
Missing Authorization
CVE CVE-2025-13722
CVSS 5.3 (Medium)
Publicly Published January 6, 2026
Last Updated January 7, 2026
Researcher Marcin Dudek (dudekmar) - CERT.PL

Description

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder.

References

Share

Vulnerability Details for Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Software Type Plugin
Software Slug fluentform (view on wordpress.org)
Patched? Yes
Remediation Update to version 6.1.8, or a newer patched version
Affected Version
  • <= 6.1.7
Patched Version
  • 6.1.8

Recent vulnerabilities in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
7.2
CVE-2026-18146
Aug 12, 2026
Researcher: Adrien Brunner
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
6.1
CVE-2026-17571
Jul 31, 2026
Researcher: Osvaldo Noe Gonzalez Del Rio (Os)
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
5.3
CVE-2026-17567
Jul 30, 2026
Researcher: ChinhNguyen
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-11881
Jul 30, 2026
Researcher: Muni Nitish Kumar Yaddala
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
7.2
CVE-2026-16655
Jul 28, 2026
Researcher: daroo
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
5.4
CVE-2026-5069
Jul 9, 2026
Researcher: Fernando Mecozzi
Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
8.2
CVE-2026-5395
May 13, 2026
Researcher: Sander Horsman
Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter
8.2
CVE-2026-5396
May 13, 2026
Researcher: Sander Horsman
Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
6.4
CVE-2026-6828
May 12, 2026
Researcher: zaim
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
4.9
CVE-2026-6344
May 5, 2026
Researcher: Niv Kochan
# Title CVE ID CVSS Researchers Date
1 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values CVE-2026-18146 7.2 Adrien Brunner August 12, 2026
2 Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' CVE-2026-17571 6.1 Osvaldo Noe Gonzalez Del Rio (Os) July 31, 2026
3 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter CVE-2026-17567 5.3 ChinhNguyen July 30, 2026
4 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-11881 6.4 Muni Nitish Kumar Yaddala July 30, 2026
5 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member CVE-2026-16655 7.2 daroo July 28, 2026
6 Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' CVE-2026-5069 5.4 Fernando Mecozzi July 9, 2026
7 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter CVE-2026-5395 8.2 Sander Horsman May 13, 2026
8 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter CVE-2026-5396 8.2 Sander Horsman May 13, 2026
9 Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute CVE-2026-6828 6.4 zaim May 12, 2026
10 Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment CVE-2026-6344 4.9 Niv Kochan May 5, 2026
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation