CVE-2026-2899: 
WordPress vulnerability analysis and mitigation

CVE-2026-2899 is a Missing Authorization vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress, affecting all versions up to and including 6.1.17. The flaw allows unauthenticated attackers to delete arbitrary WordPress media attachments by exploiting an unprotected AJAX action. It was published on March 5, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). The deleteFile() method in the Uploader class lacks both nonce verification and capability checks. The AJAX action is registered via addPublicAjaxAction(), which creates both wp_ajax_ and wp_ajax_nopriv_ hooks — the latter allowing unauthenticated users to invoke the action. Exploitation is achieved by sending a crafted AJAX request with a valid attachment_id parameter to trigger deletion of arbitrary media attachments. Notably, path-based deletion via the path parameter is not exploitable because the code uses Protector::decrypt() rather than the simpler sanitize_file_name() described by the original researcher (Wordfence, EUVD).

Successful exploitation allows unauthenticated remote attackers to permanently delete arbitrary WordPress media attachments (images, documents, uploads) from the affected site. This results in low integrity impact (unauthorized deletion of content) and low availability impact (loss of media assets), with no confidentiality impact. While the vulnerability does not enable code execution or data exfiltration, mass deletion of media files could significantly disrupt site functionality and cause data loss for content-heavy WordPress installations (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.082%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence, EUVD).

1. Reconnaissance: Identify WordPress sites running the Fluent Forms Pro Add On Pack plugin version ≤ 6.1.17 using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Identify target attachment IDs: Browse the target WordPress site to enumerate media attachment IDs. These are often exposed in page source, REST API endpoints (/wp-json/wp/v2/media), or by inspecting image URLs (e.g., ?attachment_id=123).
3. Craft the malicious AJAX request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter corresponding to the Fluent Forms file deletion handler and the target attachment_id.

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.example.com
   Content-Type: application/x-www-form-urlencoded
   
   action=fluentform_delete_file&attachment_id=<TARGET_ID>

4. Confirm deletion: Verify the media attachment has been removed by attempting to access its URL or checking the WordPress media library response. Repeat for additional attachment IDs to cause broader disruption (Wordfence).

• Network: Repeated unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php with action parameters related to Fluent Forms file deletion (e.g., fluentform_delete_file) and varying attachment_id values from a single or small set of IP addresses.
• Logs: WordPress access logs showing POST requests to admin-ajax.php without authentication cookies, particularly with Fluent Forms-related action parameters; HTTP 200 responses to these requests indicating successful processing.
• File System: Missing media files from the WordPress uploads directory (/wp-content/uploads/) that were previously present; gaps in media library entries in the WordPress database (wp_posts table with post_type = 'attachment').
• Database: Unexpected deletions in the wp_posts and wp_postmeta tables for attachment post types, particularly if correlated with suspicious access log timestamps.

Users should update the Fluent Forms Pro Add On Pack plugin to a version above 6.1.17 that includes the fix (adding nonce verification and capability checks to the deleteFile() method). The vendor changelog is available at the Fluent Forms documentation site. As an interim workaround, site administrators can disable the plugin until a patched version is applied, or use a Web Application Firewall (WAF) rule to block unauthenticated POST requests to admin-ajax.php with Fluent Forms deletion action parameters (Wordfence, Fluent Forms Changelog).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry noting the nuance that the originally described path-based exploitation vector is not viable due to the use of Protector::decrypt(), and clarified that the actual exploitable vector is via the attachment_id parameter. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database aggregation (Wordfence).