ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2899

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17.

Published Mar 5, 2026 · updated Jun 17, 2026

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the method in the class lacking nonce verification and capability checks. The AJAX action is registered via which creates both and hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the parameter. Note: The researcher described file deletion via the parameter using , but the actual code uses for path-based deletion which prevents exploitation. The vulnerability is exploitable via the parameter instead.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 5, 2026 · NIST NVD

    Detected

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the method in the class lacking nonce verification and capability checks. The AJAX action is registered via which creates both and hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the method in the class lacking nonce verification and capability checks. The AJAX action is registered via which creates both and hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the

Sources

  • NIST NVDVulnerability recordCVE-2026-2899

    The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the method in the class lacking nonce verification and capability checks. The AJAX action is registe

    nvd.nist.gov

References