Fluent Forms Plugin Vulnerable to Privilege Escalation Attacks

CVE-2024-2771

Summary

The Contact Form Plugin by Fluent Forms is susceptible to a privilege escalation vulnerability stemming from a lack of appropriate capability checks in the /wp-json/fluentform/v1/managers REST API endpoint. This issue allows unauthenticated attackers to assign management permissions to any user, granting them complete access to all settings and features of the plugin. Furthermore, this vulnerability enables attackers to delete manager accounts, posing significant risks to the integrity and security of the WordPress site utilizing this plugin. Immediate attention to update to the latest version is essential to mitigate potential exploits.

References