CVE-2026-6344

The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This is due to insufficient path validation in the getAttachments() method of EmailNotificationActions, which resolves attacker-supplied file-upload URLs into filesystem paths without verifying that the resolved path stays inside the WordPress uploads directory: a strpos() prefix check on the raw URL can be bypassed with traversal sequences, wp_normalize_path() does not resolve ".\..\" segments, and file_exists() then resolves them at the kernel level. This makes it possible for authenticated attackers with administrator access to read arbitrary files readable by the web-server user — including wp-config.php with its database credentials and authentication salts — by submitting a form whose admin notification is configured to attach a file-upload field and supplying a crafted URL of the shape <upload_baseurl>/../../<target> as the file-field value. The resolved file is attached to the outbound admin-notification email via wp_mail(). While the email can be triggered by unauthenticated users, the email recipient is not user-controlled.

• CWE-22

• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Hooks/Ajax.php#L17
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Modules/SubmissionHandler/SubmissionHandler.php#L17
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php#L121
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php#L130
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php#L133
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php#L135
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php#L137
• https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php#L151
• https://plugins.trac.wordpress.org/changeset/3513845/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotificationActions.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0101113b-70c2-4db4-b6b1-b2412f6e1214?source=cve

Published

May 6, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63428HeyForm is an open-source form builder. Prior to version 3.0…5.8
• CVE-2026-63429HeyForm is an open-source form builder. Prior to version 3.0…8.6
• CVE-2026-6343Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…4.3
• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1
• CVE-2026-63446Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion …5.9
• CVE-2026-63449Suricata is a network Intrusion Detection System, Intrusion …3.7