Arbitrary File Write Vulnerability in Cloud Storage Manager for Fluent Forms by WordPress
CVE-2026-120522

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Cloud Storage Manager For Fluent Forms – Google Drive, Dropbox, Onedrive, S3 Uploads
Vendor
CVE Published:
14 November 2026

What is CVE-2026-120522?

The Cloud Storage Manager for Fluent Forms plugin for WordPress is susceptible to Arbitrary File Write due to inadequate authorization checks on critical REST endpoints. This vulnerability allows unauthenticated users to exploit insufficient path validation while managing file downloads. Attackers can leverage this flaw to save malicious Google Drive credentials and initiate downloads of their own files, potentially executing unwanted code when the files are saved with certain extensions in web-accessible locations.

Affected Version(s)

Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads 0 <= 1.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3656663/clou...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Rayyan Aryasatya
.