CVE-2024-2771

CVE-2024-2771 describes a critical privilege escalation vulnerability in the Fluent Forms plugin for WordPress, affecting all versions up to and including 5.1.16. This flaw allows unauthenticated attackers to grant themselves Fluent Form management permissions, providing full access to plugin settings and features, and even enabling the deletion of existing manager accounts. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low complexity and can lead to complete compromise of confidentiality, integrity, and availability. While no active exploitation or Metasploit modules are reported, Nuclei templates exist, and despite its high FAUCET Risk Score, there is currently no significant community discussion or media coverage.