Arbitrary File Read Vulnerability in Fluent Forms Plugin for WordPress

CVE-2026-6344

What is CVE-2026-6344?

The Fluent Forms plugin for WordPress has a vulnerability that allows authenticated attackers with administrator access to read arbitrary files on the server due to insufficient path validation in the getAttachments() method of EmailNotificationActions. Attackers can craft a URL leading to files outside the intended directory by exploiting traversal sequences. This can result in the exposure of sensitive files such as wp-config.php, which contains critical database credentials. The exploit is facilitated through form submissions that trigger email notifications with malicious file attachments, opening up significant security risks for affected installations.

References