Vulnerability Description
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter. Note: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://fluentforms.com/docs/changelog/#3-toc-title
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835
FAQ
What is CVE-2026-2899?
CVE-2026-2899 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` cl...
How severe is CVE-2026-2899?
CVE-2026-2899 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-2899?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.