Fluent Forms WordPress Plugin Incorrect Authorization Vulnerability Allowing Arbitrary Subscription Cancellation

A vulnerability exists in the Fluent Forms plugin for WordPress, specifically in versions through 6.2.1. The issue arises from inadequate authorization checks in the payment cancellation AJAX process, allowing authenticated users with subscriber-level access or higher to cancel subscriptions belonging to other users by manipulating the 'subscription_id' parameter.

Impact

Exploitation of this vulnerability allows for unauthorized cancellation of user subscriptions, potentially disrupting service or access for those users.

Remediation

Users can update to Fluent Forms version 6.2.2 or a newer patched version to address this vulnerability.