CVE-2026-5069

mediumCVSS 5.4covered by 1 sourcefirst seen 2026-07-10

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

⚡ Watch CVE-2026-5069

Get an email if CVE-2026-5069 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-5069: The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscri…nvd · 2026-07-10

External references

NVD record for CVE-2026-5069

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-5069 status](https://www.csirts.com/badge/CVE-2026-5069)](https://www.csirts.com/cve/CVE-2026-5069)