CVE-2026-15178

Name of the Vulnerable Software and Affected Versions Fluent Forms versions prior to 6.2.6

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with Custom-level access or higher can read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.

Recommendations Update Fluent Forms to version 6.2.6 or later.