{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13722", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-25T22:21:02.440Z", "datePublished": "2026-01-07T09:21:06.416Z", "dateUpdated": "2026-04-08T17:33:50.308Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:50.308Z"}, "affected": [{"vendor": "techjewel", "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder."}], "title": "Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7dbf179-7099-4dfb-8dad-780f996a7005?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Ai/AiFormBuilder.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-11-25T22:38:33.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-06T20:40:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:33:20.327471Z", "id": "CVE-2025-13722", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:33:28.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:33:20.327471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:33:24.891Z"}}], "cna": {"title": "Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder", "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "techjewel", "product": "Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-25T22:38:33.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-06T20:40:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7dbf179-7099-4dfb-8dad-780f996a7005?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Ai/AiFormBuilder.php"}], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:50.308Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13722", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:50.308Z", "dateReserved": "2025-11-25T22:21:02.440Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T09:21:06.416Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder."}, {"lang": "es", "value": "El plugin Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, &amp; Conversational Form Builder para WordPress es vulnerable a la falta de autorizaci\u00f3n en todas las versiones hasta la 6.1.7, inclusive. Esto se debe a la falta de comprobaciones de capacidad en la acci\u00f3n AJAX 'fluentform_ai_create_form'. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, creen formularios arbitrarios a trav\u00e9s del constructor de IA expuesto p\u00fablicamente."}], "id": "CVE-2025-13722", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-07T12:16:49.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3406804/fluentform/tags/6.1.8/app/Modules/Ai/AiFormBuilder.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7dbf179-7099-4dfb-8dad-780f996a7005?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:29:27.222553+00:00", "value": {"mitigation_remediation": ["Update Fluent Forms to version 6.1.8 or later where the capability check has been added", "If a patch is unavailable, disable the AI Builder feature through the plugin settings or by removing the related code from the plugin directory", "Monitor the forms created on the site for unexpected or suspicious entries and revoke access for any accounts that create unauthorized forms"], "summary": {"action": "Patch", "impact": "Unauthorized Form Creation"}, "threat_synthesis": {"affected_systems": "All instances of Techjewel's Fluent Forms plugin for WordPress with versions up to and including 6.1.7 are affected. No further version granularity is available in the CNA data.", "description_and_impact": "The vulnerability resides in the Fluent Forms plugin for WordPress, where the AJAX action `fluentform_ai_create_form` lacks proper capability checks. This oversight allows authenticated users who possess a Subscriber role or higher to create arbitrary forms through the publicly exposed AI Builder interface. The primary impact is the unauthorized creation of forms, which could be leveraged for phishing, spam, or other malicious content, representing a moderate\u2011severity privilege escalation flaw (CWE\u2011862).", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood that this vulnerability is actively exploited. The issue is not listed in the CISA KEV catalog, implying it is not a known widely used exploit at the time of this analysis. Attackers would need to authenticate to the WordPress site with a Subscriber-level account or higher and then send a crafted AJAX request to the `fluentform_ai_create_form` endpoint, which the plugin fails to guard, thereby enabling creation of arbitrary forms."}}}}, "created": "2026-01-08T09:49:25.754793+00:00", "updated": "2026-04-21T00:30:22.981003+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}