Fluent Forms Pro 6.2.7 Backdoor via Malicious Plugin Build

Executive Summary

This vulnerability involves a tampered version of Fluent Forms Pro 6.2.7 distributed through a decommissioned update server. The malicious build included a rogue PHP file that created a backdoor REST API endpoint, installed a passwordless admin account, and added persistent PHP files in directories like mu-plugins and uploads. Even after plugin removal, the backdoor and scheduled tasks remained active.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the malicious PHP file libs/class-license-sync.php in the Fluent Forms Pro plugin directory. Look for a require_once directive in fluentformpro.php loading this file. Inspect the mu-plugins and uploads directories for unexpected PHP files. Check for a passwordless administrator account in WordPress user settings and review scheduled tasks for unauthorized entries.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this backdoor to gain unauthorized access to your website, install malware, inject unwanted ads, or perform other malicious activities. The vulnerability allows persistent access even after removing the plugin, as malicious files and scheduled tasks remain. Users who updated during the five-hour window (July 31, 2026, 14:00–19:00 UTC) are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data exfiltration, or persistent backdoors, which may violate GDPR's data protection requirements (e.g., Articles 32, 33) and HIPAA's security rules (e.g., 45 CFR 164.308, 164.312). Unauthorized administrator accounts and persistent PHP files could result in unauthorized processing or disclosure of personal data, triggering breach notification obligations under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Fluent Forms Pro to version 6.2.8 or later. Remove the affected plugin if already installed. Delete any suspicious PHP files in mu-plugins and uploads directories. Check WordPress for unauthorized administrator accounts and remove them. Review and clean up any unauthorized scheduled tasks or database entries.

Useful 0 Not Useful 0