CVE-2026-120522
Deferred Deferred - Pending Action

Arbitrary File Write in Cloud Storage Manager for Fluent Forms WordPress Plugin

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: Wordfence

Description
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the `connection/{driver}/save` and `/download/single-file` REST endpoints, combined with insufficient path validation in the Google Drive `downloadFile()` function, where the Google Drive metadata `name` value is concatenated into a local path without `basename()`, `sanitize_file_name()`, or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended `downloads` directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-120522
EUVD
EUVD-2026-125904

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fluentwiz Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads From 0 (inc) to 1.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Arbitrary File Write flaw in the Cloud Storage Manager plugin for WordPress. It allows unauthenticated attackers to write files outside the intended directory by exploiting missing authorization checks and insufficient path validation in specific REST endpoints. Attackers can store malicious credentials and trigger downloads of files with path traversal in filenames, potentially leading to remote code execution if PHP files are written in web-accessible locations.

Detection Guidance

Check for unauthorized file writes in web-accessible directories, especially PHP files outside intended locations. Inspect logs for suspicious REST endpoint access to connection/{driver}/save or /download/single-file. Use commands like grep to search for unexpected files or modifications in /wp-content/uploads/ or similar directories.

Impact Analysis

If you use the affected plugin, attackers could upload malicious files to your server, including PHP files that execute arbitrary code. This could allow complete control over your WordPress site, data theft, or further attacks on your server. The vulnerability requires no authentication, making it particularly dangerous.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. A successful exploit may result in data breaches, triggering legal penalties, fines, or compliance violations for organizations handling protected information.

Mitigation Strategies

Immediately update the Cloud Storage Manager plugin to the latest version if available. Disable the plugin if no update is available. Restrict write permissions to web directories. Monitor for unauthorized file creation or modifications. Consider blocking external access to the vulnerable REST endpoints via firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...