An authorization bypass vulnerability in the WordPress Fluent Forms plugin allows unauthenticated attackers to access sensitive form submission data.

The plugin fails to properly validate user-controlled keys, leading to an authorization bypass (CWE-639) that allows unauthenticated users to access or manipulate form data.

With a CVSS score of 8.2, this vulnerability poses a significant risk to data privacy. Attackers can gain unauthorized access to potentially sensitive information submitted through contact forms, surveys, or quizzes, leading to data breaches and regulatory compliance issues.

Immediate Action: Update the Fluent Forms plugin to version 6.2.0 or later immediately.

Proactive Monitoring: Monitor form submission logs for unexpected access patterns and verify that no unauthorized individuals have accessed form data.

Compensating Controls: If the update cannot be applied immediately, deactivate the plugin to prevent exploitation of the vulnerability.

Public Exploit Available: Unknown

WordPress administrators should update the Fluent Forms plugin to version 6.2.0 without delay. Given the potential for data exposure, it is recommended to review form submissions for any signs of unauthorized access once the patch is applied.