CVE

CVE-2024-2782

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

fluent forms – customizable contact forms, survey, quiz, & conversational form builder

Updated Sep 26, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2024-2782 Scanner

CVE-2024-2782 Scanner - Broken Access Control vulnerability in WordPress FluentForms

Used 3.1k times · 3.4k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: fluent forms – customizable contact forms, survey, quiz, & conversational form builder

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →