CVE-2024-5053

Name of the Vulnerable Software and Affected Versions: Fluent Forms versions up to, and including, 5.1.18

Description: The issue is related to an insufficient capability check on the verifyRequest function, allowing Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. Additionally, missing Mailchimp API key validation enables the redirect of integration requests to an attacker-controlled server.

Recommendations: For versions up to, and including, 5.1.18, update to the latest version of Fluent Forms to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the Mailchimp API key integration to prevent unauthorized modifications.