CVE-2026-120522 is a critical (CVSS 9.8) arbitrary file write in the Cloud Storage Manager for Fluent Forms WordPress plugin that can lead to remote code execution without authentication.
What Is It
CVE-2026-120522 is a path traversal (CWE-22) flaw in the Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress. Wordfence reported it, and NVD published it on 2026-11-14.
The flaw combines two problems:
- Missing authorization checks on the
connection/{driver}/saveand/download/single-fileREST endpoints. - Insufficient path validation in the Google Drive
downloadFile()function. The plugin adds the filenamefrom Google Drive metadata to a local path without applyingbasename(),sanitize_file_name()or canonical path validation.
An unauthenticated attacker can save their own Google Drive credentials to the plugin. They can then make the site download a file from their Drive whose filename contains path traversal sequences. That writes attacker-controlled content outside the intended downloads directory.
Why It Matters
If the written file has a PHP extension and lands in a web-accessible location, the attacker gets remote code execution on the site.
The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the risk:
- It can be exploited over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- Confidentiality, integrity and availability impact are all high.
Exploitation status: The supplied CISA Known Exploited Vulnerabilities (KEV) data contains no entry for this CVE, so KEV does not confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: fluentwiz
- Product: Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads (WordPress plugin)
- Affected versions: All versions up to and including 1.2.0
The attack path described uses the plugin's Google Drive integration.
Patch Status
The NVD record links to a WordPress plugin repository changeset (3656663) for cloud-storage-manager, which suggests a code change has been made. The supplied data does not name a fixed version. There is no KEV entry, so CISA has set no required action or due date.
Administrators running version 1.2.0 or earlier should check the plugin changeset and the Wordfence advisory for current fix details and update guidance.