Auth bypass in Wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

CVE-2026-5069

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

Vulnerability class: Broken Access Control

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

EPSS: 0.003 (20.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 20.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-5069: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-5069?
CVE-2026-5069 is a medium-severity vulnerability in Wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2026-07-10.
How severe is CVE-2026-5069?
Medium severity. CVSS v3 base score is 5.4 out of 10.