CVE Database /
CVE-2026-5395
CVE · High
CVE-2026-5395 — Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.2.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-5395
|
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform] < 6.2.1 |
Authorization Bypass Through User-Controlled Key |
High
8.2
|
< 6.2.1
|
6.2.1 |
2026-05-13 |
—
|
CVE-2026-5395
The Fluent Forms plugin for WordPress, up to version 6.2.0, is susceptible to Insecure Direct Object Reference vulnerabilities through the exportEntries function. Due to insufficient validation of a user-controlled key, attackers with Fluent Forms manager-level permissions can exploit this flaw to access form submissions they shouldn't see, extract data from any database table, and discover table names by analyzing error messages.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings