CVE-2026-81297

CVE-2026-81297 is a privilege escalation flaw (CWE-266, incorrect privilege assignment) in the Fluent Forms Pro Add On Pack, the premium add-on for the Fluent Forms WordPress plugin. An attacker who already holds a subscriber-level account on an affected site — the lowest-privilege WordPress role, obtainable via open registration on many sites — can send crafted network requests to the plugin and be assigned higher privileges than intended. Successful escalation yields high impact to the site's confidentiality, integrity, and availability per the CVSS score (7.5, network vector, low privileges required, no user interaction, high attack complexity). Any WordPress site running the Pro Add On Pack at version 6.2.12 or earlier is affected. There is currently no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and its EPSS score of 0.3% (23rd percentile) suggests low near-term exploitation risk.

What to do: Update the Fluent Forms Pro Add On Pack to the latest release, i.e., any version later than 6.2.12, via the vendor's plugin update mechanism (premium add-ons do not update from WordPress.org). Confirm the installed version under WP Admin > Plugins; as interim mitigation, disable or gate new user registrations and audit existing subscriber accounts, since exploitation requires a subscriber-level login. Monitor vendor advisories from WPManageNinja/Patchstack for the fixed version number and exploitation updates.