Shahjahan Jewel FluentForm Code Injection Vulnerability

A code injection vulnerability has been identified in the Shahjahan Jewel FluentForm WordPress plugin, affecting versions through 6.1.11. This vulnerability allows for arbitrary code execution by injecting malicious content that could be executed as a shortcode.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution within the WordPress environment, allowing attackers to execute injected shortcodes that could, for example, create phishing pages.

Remediation

Users of the FluentForm WordPress plugin should update to version 6.1.12 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.