Fluent Forms Pro Missing Authorization Vulnerability Allowing Unauthenticated Deletion of Media Attachments

A vulnerability exists in the Fluent Forms Pro Add On Pack for WordPress, in all versions through 6.1.17, allowing unauthenticated users to delete arbitrary media attachments. This issue arises from the 'deleteFile()' method in the 'Uploader' class, which lacks proper nonce verification and capability checks. The vulnerability is exploited through an AJAX action that is available to both authenticated and unauthenticated users, using the 'attachment_id' parameter to target specific media items for deletion.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of WordPress media attachments, potentially leading to loss of important files or disruption of site content.

Remediation

Users can update to Fluent Forms Pro Add On Pack version 6.1.18 or later, where this vulnerability has been patched.