CVE-2024-2782
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation
HIGH 7.5EPSS 1.2%
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.
- Affected
- techjewel · Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVSS v3.1 WORDFENCE
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - EPSS
- 1.23% chance of exploitation in the next 30 days, 68th percentile
- Nuclei
- high · CWE-862
- Published
- 2024-05-18
- Updated
- 2026-04-08
Proof-of-concept exploits (1)
- whale93/CVE-2024-2782-PoC0★ · 2025-08-03
Nuclei templates (1)
Security advisories
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0814e7b3-404a-4db5-b564-46c9086…
- https://plugins.trac.wordpress.org/changeset/3088078/fluentform/trunk/app/Http/Policies/G…