CVE-2026-73532 WPManageNinja CVE debrief

Who should care

Defenders responsible for WordPress installations using Fluent Forms Pro should assess exposure and verify the integrity of their installations. Immediate attention is required to prevent potential exploitation.

Why it matters

CVE-2026-73532 is a critical vulnerability in Fluent Forms Pro 6.2.7 with a CVSS score of 9.3. The vulnerability allows for embedded malicious code, potentially leading to backdoor access, unauthorized administrator accounts, and persistence of malicious code. Defenders responsible for WordPress installations using Fluent Forms Pro should assess exposure and verify the integrity of their installations.

• Potential backdoor access via REST API endpoint
• Possible installation of unauthorized administrator accounts
• Registration of suspicious scheduled tasks
• Persistence of malicious code even after plugin removal

Technical summary

The vulnerability was introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (libs/class-license-sync.php) loaded via a require_once directive added to fluentformpro.php. This file established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Defensive priority

Immediate attention is required to assess exposure and verify the integrity of Fluent Forms Pro installations. Defenders should prioritize verifying the version of Fluent Forms Pro, checking for the presence of the rogue PHP file, and ensuring that no unauthorized administrator accounts have been created.

Recommended defensive actions

• Verify the version of Fluent Forms Pro and ensure it is not 6.2.7
• Check for the presence of the rogue PHP file (libs/class-license-sync.php) and remove it if found
• Verify that no unauthorized administrator accounts have been created
• Review scheduled tasks for any suspicious entries
• Perform a thorough review of system logs to detect any potential malicious activity
• Implement additional monitoring to detect similar vulnerabilities in the future
• Review and update incident response plans to include procedures for handling similar incidents

Evidence notes

The vulnerability was introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (libs/class-license-sync.php) loaded via a require_once directive added to fluentformpro.php. This file established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.