Security Alert Summary
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads WordPress plugin contains an arbitrary file write vulnerability that affects all versions up to and including 1.2.0. Missing authorization checks on specific REST endpoints and insufficient path validation in the Google Drive download routine can allow unauthenticated attackers to write attacker-controlled files outside the intended downloads directory. If a written file with a PHP extension is placed in a web-accessible location, this may lead to remote code execution.
CVE Details
- CVE ID: CVE-2026-120522
- Affected component: Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress
- Affected versions: All versions up to and including 1.2.0
- Published: November 14, 2026 at 1:17:20 PM UTC
- Last modified: November 14, 2026 at 1:17:20 PM UTC
- CVSS v3.1: Base Score 9.8, Severity CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction: Authentication: None required; Privileges required: None; User interaction: None
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness (CWE): CWE-22 (Path Traversal)
Technical Details
The vulnerability is caused by missing authorization checks on the REST endpoints connection/{driver}/save and /download/single-file, combined with insufficient path validation in the Google Drive downloadFile() function. The plugin concatenates the Google Drive metadata name value into a local filesystem path without using basename(), sanitize_file_name(), or other canonical path validation.
Because there are no authorization checks on the named endpoints, unauthenticated attackers can provide attacker-controlled Google Drive credentials and trigger the plugin to download a file controlled by the attacker. If the provider-returned filename contains path traversal sequences, the insufficient validation allows writes outside the intended downloads directory. Writing a file with a PHP extension into a web-accessible location can result in remote code execution.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff who manage forms and integrations, and an external contractor who occasionally uploads assets. An unauthenticated attacker could place attacker-controlled credentials and cause the plugin to download attacker-owned files whose filenames include path traversal. The attacker could then write files into locations that are normally not writable by the plugin, potentially exposing sensitive files or allowing execution of injected PHP code if a web-accessible directory is used.
Practical consequences include exposure of sensitive files stored on the server, leakage of internal user information, and increased risk of targeted phishing or social engineering if contact data or internal documentation is exposed. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or lower roles that can upload or manage integrations.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that add external integrations.
- Monitor site activity and file system changes for unusual behavior, including unexpected files in web-accessible directories.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
