CVE-2026-11578: Unknown Fluent Forms

Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days.

The Fluent Forms WordPress plugin before 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage, allowing a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration in which an administrator has created at least one Manager restricted to specific forms.

Affected products

• Unknown Fluent Forms: before 6.2.5 (fixed in 6.2.5)

Published 2026-07-02. Last modified 2026-07-02.