CVE-2026-2899 | Fluent Forms Pro Add On Pack Plugin up to 6.1.17 on WordPress Attachment Deletion deleteFile attachment_id authorization

A vulnerability categorized as critical has been discovered in Fluent Forms Pro Add On Pack Plugin up to 6.1.17 on WordPress. Affected by this issue is the function deleteFile of the component Attachment Deletion Handler. Such manipulation of the argument attachment_id leads to missing authorization.

This vulnerability is traded as CVE-2026-2899. The attack may be launched remotely. There is no exploit available.