CVE-2026-2899

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter. Note: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead.

• CWE-862

• https://fluentforms.com/docs/changelog/#3-toc-title
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835d-038b765c68a6?source=cve

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28982A race condition was addressed with improved locking. This i…9.8
• CVE-2026-28983A type confusion issue was addressed with improved checks. T…7.5
• CVE-2026-28985A null pointer dereference was addressed with improved input…6.2
• CVE-2026-28986A race condition was addressed with additional validation. T…7.5
• CVE-2026-28987A logging issue was addressed with improved data redaction. …7.5
• CVE-2026-28988A permissions issue was addressed with additional restrictio…5.5
• CVE-2026-28990The issue was addressed with improved memory handling. This …7.5
• CVE-2026-28991An out-of-bounds read was addressed with improved bounds che…7.5
• CVE-2026-28992A memory corruption vulnerability was addressed with improve…4.7
• CVE-2026-28993This issue was addressed by adding an additional prompt for …5.5
• CVE-2026-28994A use after free issue was addressed with improved memory ma…5.3
• CVE-2026-28995A logic issue was addressed with improved restrictions. This…8.8