Description
The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Fluent Forms | < 6.2.1 | 6.2.1 |
References
- https://wpscan.com/vulnerability/5de7c9e9-3a47-4bc6-a1b2-33eb8d3e3ec0/ exploit vdb-entry technical-description