Fluent Forms Insecure Direct Object Reference Bypasses Access Controls

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.0 via the exportEntries function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Fluent Forms manager-level access and above, to bypass form-level access restrictions to access submissions from forms they are not authorized to view, export data from arbitrary database tables, and enumerate database table names via error message disclosure.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Fluent Forms – Customizable Contact Forms plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in the exportEntries function that allows authenticated users with manager-level access to bypass form-level authorization checks. By manipulating user-controlled parameters, attackers can access form submissions they should not have permission to view, effectively escalating their privileges within the plugin. This vulnerability affects all versions up to 6.2.0 and is particularly dangerous in multi-tenant or multi-user WordPress environments where form submissions may contain sensitive customer data, personal information, or business intelligence. Organizations relying on Fluent Forms for data collection and management face potential data exposure and compliance violations.

Casky's 261 matching skills leverage Claude's extended reasoning to detect the exploitation patterns associated with TA0004 (Privilege Escalation) and TA0006 (Credential Access) techniques. Practitioners using Casky would identify suspicious activity such as authenticated requests to exportEntries with manipulated object identifiers, unusual cross-form access attempts from single user sessions, and patterns of parameter tampering on form submission endpoints. The platform's MITRE ATT&CK mapping would highlight how attackers establish foothold access (initial compromise via manager credentials) before exploiting the IDOR flaw to laterally access restricted data. Security teams would see anomalous form-level permission violations, rapid sequential requests to different form IDs, and exported datasets inconsistent with user role assignments—enabling detection and response before unauthorized data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5395.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-5395

Casky has 261 skills that investigate the attack patterns behind CVE-2026-5395. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn