WordPress Plugin Vulnerabilities

Fluent Forms < 6.2.1 - Form Manager+ Authorization Bypass via 'table' Parameter

Description

The plugin is vulnerable to Insecure Direct Object Reference via the `exportEntries` function due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with Fluent Forms Manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.

Affects Plugins

Fixed in 6.2.1

References

Classification

Type
IDOR
CWE
CVSS

Miscellaneous

Original Researcher
Sander Horsman
Verified
No

Timeline

Publicly Published
2026-05-13 (about 5 months ago)
Added
2026-05-18 (about 4 months ago)
Last Updated
2026-05-18 (about 4 months ago)

Other