Medium severity · published Jul 10, 2026
CVE-2026-5069
Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder · wpmanageninja
through 6.2.1 · source: vendor
Affected product
FF
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
wpmanageninja
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5069
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5069
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3513845/fluentform
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9?source=cve
More from Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
7.2
CVE-2026-18146
Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
7.2
CVE-2026-16655
Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
6.1
CVE-2026-17571
Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'
5.4
CVE-2026-15178
Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
5.3
CVE-2026-17567
Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter