CVE-2026-2899

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2899", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-20T19:07:46.936Z", "datePublished": "2026-03-05T03:23:41.411Z", "dateUpdated": "2026-04-08T17:18:22.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:22.782Z"}, "affected": [{"vendor": "techjewel", "product": "Fluent Forms Pro Add On Pack", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.1.17", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter.\r\n\r\nNote: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead."}], "title": "Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835d-038b765c68a6?source=cve"}, {"url": "https://fluentforms.com/docs/changelog/#3-toc-title"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Prickly Cactus"}], "timeline": [{"time": "2026-02-20T19:30:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-04T14:34:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:39:23.144028Z", "id": "CVE-2026-2899", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:41:28.855Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:39:23.144028Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:39:24.234Z"}}], "cna": {"title": "Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Prickly Cactus"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "techjewel", "product": "Fluent Forms Pro Add On Pack", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.1.17"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-20T19:30:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-04T14:34:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835d-038b765c68a6?source=cve"}, {"url": "https://fluentforms.com/docs/changelog/#3-toc-title"}], "descriptions": [{"lang": "en", "value": "The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter.\r\n\r\nNote: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:22.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2899", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:18:22.782Z", "dateReserved": "2026-02-20T19:07:46.936Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-05T03:23:41.411Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fluent Forms Pro Add On Pack", "vendor": "techjewel", "versions": [{"lessThanOrEqual": "6.1.17", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter.\r\n\r\nNote: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead."}, {"lang": "es", "value": "El plugin Fluent Forms Pro Add On Pack para WordPress es vulnerable a Autorizaci\u00f3n Faltante en todas las versiones hasta la 6.1.17, inclusive. Esto se debe a que el m\u00e9todo 'deleteFile()' en la clase 'Uploader' carece de verificaci\u00f3n de nonce y comprobaciones de capacidad. La acci\u00f3n AJAX se registra a trav\u00e9s de 'addPublicAjaxAction()', lo que crea los hooks 'wp_ajax_' y 'wp_ajax_nopriv_'. Esto hace posible que atacantes no autenticados eliminen archivos adjuntos de medios de WordPress arbitrarios a trav\u00e9s del par\u00e1metro 'attachment_id'.\n\nNota: El investigador describi\u00f3 la eliminaci\u00f3n de archivos a trav\u00e9s del par\u00e1metro 'path' usando 'sanitize_file_name()', pero el c\u00f3digo real usa 'Protector::decrypt()' para la eliminaci\u00f3n basada en la ruta, lo que evita la explotaci\u00f3n. La vulnerabilidad es explotable a trav\u00e9s del par\u00e1metro 'attachment_id' en su lugar."}], "id": "CVE-2026-2899", "lastModified": "2026-06-17T10:31:59.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2899", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T15:39:23.144028Z", "version": "2.0.3"}}]}, "published": "2026-03-05T04:15:57.233", "references": [{"source": "security@wordfence.com", "url": "https://fluentforms.com/docs/changelog/#3-toc-title"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835d-038b765c68a6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.17]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Fluent Forms Pro Add On Pack", "source": "cna", "vendor": "techjewel"}, "product": "fluent_forms_pro_add_on_pack", "vendor": "techjewel"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T16:48:33.526956+00:00", "value": {"mitigation_remediation": ["Upgrade the Fluent Forms Pro Add On Pack plugin to version 6.1.18 or later, where the deleteFile() method is protected by nonce verification and capability checks.", "If an upgrade is not immediately possible, remove or disable the public AJAX action that deletes files by commenting out or deleting the addPublicAjaxAction() hook for the \u2018delete_file\u2019 action, or modify the plugin to add a capability check such as current_user_can('delete_posts') before proceeding.", "Implement a temporary network\u2011level block on the AJAX endpoint (e.g., using ModSecurity or a firewall rule that rejects requests to the delete_file action from unauthenticated IPs) until the plugin is updated.", "Audit all remaining plugins and themes for similar missing\u2011authorization issues to prevent further accidental data deletion."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary deletion of WordPress media attachments"}, "threat_synthesis": {"affected_systems": "All installations of techjewel\u2019s Fluent Forms Pro Add On Pack up to and including version 6.1.17 are affected. The vulnerability originates in the Uploader class and is triggered via the public Ajax action registered by addPublicAjaxAction(). Administrators who have not upgraded their plugin to a version newer than 6.1.17 remain at risk.\n\n", "description_and_impact": "The Fluent Forms Pro Add On Pack plugin for WordPress contains an authorization flaw that permits any unauthenticated user to invoke the deleteFile() routine through a public AJAX endpoint. Because the routine lacks nonce verification and capability checks, an attacker can supply an attachment_id and have the system permanently remove the corresponding media file from the WordPress library. This deletion ability threatens site integrity by erasing images, documents, or other media assets that administrators or users rely on.\n\n", "risk_and_exploitability": "With a CVSS score of 6.5 the vulnerability is classified as moderate, and the current EPSS estimate is below 1\u202f%, indicating that real-world exploitation is unlikely at present. Nevertheless, the flaw is exploitable over the network by anyone with access to the site, and it requires only knowledge of an attachment ID, which can be discovered through normal media library queries or the WordPress REST API. As the flaw is not listed in the CISA KEV catalog, no immediate incident response measures are mandated, but the lack of authentication and authorisation makes it a priority for patching."}}}}, "created": "2026-03-06T15:17:52.630614+00:00", "updated": "2026-04-15T17:00:07.052046+00:00", "vendors": ["techjewel", "techjewel$PRODUCT$fluent_forms_pro_add_on_pack", "wordpress", "wordpress$PRODUCT$wordpress"]}