CVE-2026-6344
Deferred Deferred - Pending Action
Arbitrary File Read in Fluent Forms WordPress Plugin

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: Wordfence

Description
The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1. This is due to insufficient path validation in the getAttachments() method of EmailNotificationActions, which resolves attacker-supplied file-upload URLs into filesystem paths without verifying that the resolved path stays inside the WordPress uploads directory: a strpos() prefix check on the raw URL can be bypassed with traversal sequences, wp_normalize_path() does not resolve ".\..\" segments, and file_exists() then resolves them at the kernel level. This makes it possible for authenticated attackers with administrator access to read arbitrary files readable by the web-server user — including wp-config.php with its database credentials and authentication salts — by submitting a form whose admin notification is configured to attach a file-upload field and supplying a crafted URL of the shape <upload_baseurl>/../../<target> as the file-field value. The resolved file is attached to the outbound admin-notification email via wp_mail(). While the email can be triggered by unauthenticated users, the email recipient is not user-controlled.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-06
EPSS Evaluated
2026-06-14
NVD
CVE-2026-6344
EUVD
EUVD-2026-27536
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wpfluent fluent_forms to 6.2.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Fluent Forms plugin for WordPress has a vulnerability called Arbitrary File Read in versions up to and including 6.2.1. This happens because the plugin does not properly validate file paths in the getAttachments() method of EmailNotificationActions. Specifically, it resolves attacker-supplied file-upload URLs into filesystem paths without ensuring the path stays within the WordPress uploads directory.

An attacker with administrator access can bypass the prefix check on the raw URL by using directory traversal sequences (like ../../) that are not properly normalized. This allows them to read arbitrary files that the web server user can access, including sensitive files such as wp-config.php which contains database credentials and authentication salts.

The attacker submits a form with an admin notification configured to attach a file-upload field and supplies a crafted URL pointing outside the uploads directory. The targeted file is then attached to an outbound admin notification email via wp_mail(). Although the email can be triggered by unauthenticated users, the recipient of the email is not controlled by the attacker.

Impact Analysis

This vulnerability can allow an attacker with administrator access to read arbitrary files on the server that the web server user can access. This includes sensitive configuration files such as wp-config.php, which contains database credentials and authentication salts.

By obtaining such sensitive information, an attacker could compromise the security of the WordPress site, potentially leading to data breaches, unauthorized access, or further exploitation.

Since the vulnerability involves reading files and exposing sensitive data via email notifications, it could lead to leakage of confidential information.

Compliance Impact

This vulnerability allows authenticated administrators to read arbitrary files on the server, including sensitive files such as wp-config.php which contains database credentials and authentication salts.

Exposure of such sensitive information could lead to unauthorized access or data breaches, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive data.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart