Fluent Forms Plugin Vulnerable to Privilege Escalation Attacks

CVE-2024-2771

What is CVE-2024-2771?

The Contact Form Plugin by Fluent Forms is susceptible to a privilege escalation vulnerability stemming from a lack of appropriate capability checks in the /wp-json/fluentform/v1/managers REST API endpoint. This issue allows unauthenticated attackers to assign management permissions to any user, granting them complete access to all settings and features of the plugin. Furthermore, this vulnerability enables attackers to delete manager accounts, posing significant risks to the integrity and security of the WordPress site utilizing this plugin. Immediate attention to update to the latest version is essential to mitigate potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References