Fluent Forms Authorization Bypass Vulnerability via User-Controlled 'form_id' Parameter

A vulnerability exists in the Fluent Forms plugin for WordPress, in all versions up to and including 6.1.21, allowing for authorization bypass through user-controlled 'form_id' parameters. The issue arises in the SubmissionPolicy class, which authorizes actions related to form submissions based on the 'form_id' provided by the user. This vulnerability enables authenticated attackers with Fluent Forms Manager access limited to certain forms, to manipulate submissions of other forms by falsifying the 'form_id' parameter.

Impact

Exploitation of this vulnerability allows authenticated users to bypass authorization restrictions, enabling them to read, modify, add notes to, and permanently delete form submissions from any form, regardless of their assigned permissions.

Remediation

Users are advised to update the Fluent Forms plugin to version 6.2.0 or later.