Security Alert Summary
Authenticated users with low-privilege accounts can cancel subscriptions belonging to other users in the Fluent Forms plugin versions prior to 6.2.1. The issue stems from insufficient verification of subscription ownership before processing cancellation requests. Site owners should verify plugin versions and user privileges and consider a professional review if unsure about exposure.
CVE Details
- CVE ID: CVE-2026-11880
- Affected component: Fluent Forms WordPress plugin
- Affected versions: Versions before 6.2.1
- Published: July 1, 2026 at 7:16:22 AM UTC
- Last modified: July 1, 2026 at 11:16:23 AM UTC
- CVSS v3.1 base score: 3.1
- CVSS v3.1 severity: LOW
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated, low-privilege user account (PR:L). No user interaction required (UI:N).
- Primary impact:
- Confidentiality: None
- Integrity: Low (unauthorized modification of subscription state)
- Availability: None
- CWE / weakness ID: Not specified in the provided data
Technical Details
The plugin does not properly verify ownership before processing a subscription cancellation request. As described in the advisory, an authenticated user with a low-privilege account can submit a cancellation request for a subscription that belongs to another user. This is an authorization/ownership-check failure: the plugin accepts and processes cancellation requests without confirming that the requesting user is the owner of the targeted subscription.
No specific functions, REST endpoints, or parameter names were provided in the source data. The practical effect is that subscription records can be altered (cancelled) by users who should not have that capability, resulting in unauthorized modification of subscription state for other accounts.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, internal staff who manage content, and external contractors or contributors. If a contractor or low-privilege account can cancel subscriptions they do not own, legitimate subscribers may lose access to subscription-based features or receive unexpected billing or access changes. While the vulnerability does not directly disclose confidential data, cancelled subscriptions and resulting notifications could cause confusion and increase the risk of social engineering or targeted phishing if combined with other information exposures.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and subscription logs for unusual cancellation events or patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
