CVE-2026-11578 – Fluent Forms < 6.2.5 – Form Manager+ Cross-Form Submission Entry Deletion via IDOR

CVE ID :CVE-2026-11578

Published : July 2, 2026, 6 a.m. | 1 hour, 46 minutes ago

Description :The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…