WordPress Plugin Vulnerabilities
Fluent Forms < 6.2.1 - Form Manager+ Authorization Bypass via 'table' Parameter
Description
The plugin is vulnerable to Insecure Direct Object Reference via the `exportEntries` function due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with Fluent Forms Manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.
Affects Plugins
References
Classification
Type
IDOR
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Sander Horsman
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-05-13 (about 5 months ago)
Added
2026-05-18 (about 4 months ago)
Last Updated
2026-05-18 (about 4 months ago)