A tampered build of the Fluent Forms Pro WordPress plugin, distributed through a decommissioned update server, carried malicious code that installed a persistent backdoor on any site that received it.
What Is It
CVE-2026-73532 covers embedded malicious code in Fluent Forms Pro 6.2.7 from WPManageNinja. The affected build was not compromised at runtime by an attacker exploiting a coding flaw; the shipped package itself was tampered with and served through a decommissioned update server.
The malicious build added a rogue PHP file, libs/class-license-sync.php, loaded through a require_once directive inserted into fluentformpro.php. Once active, that code:
- established a backdoor REST API endpoint
- dropped persistent PHP files into the
mu-pluginsanduploadsdirectories - installed a passwordless administrator account
- registered scheduled tasks that survived plugin removal
The backdoor endpoint is reachable over the network, and reaching it requires no authentication and no interaction from a site user or administrator.
Why It Matters
The impact is full site compromise across confidentiality, integrity, and availability. The backdoor is reachable over the network without authentication, and it hands an attacker administrator-level access via the passwordless account it creates.
The persistence design is the real problem. Files planted in mu-plugins and uploads, plus scheduled tasks, are explicitly described as surviving plugin removal. Uninstalling Fluent Forms Pro does not clean the host.
Any site that pulled 6.2.7 from the decommissioned update server should be treated as compromised rather than merely vulnerable; the malicious code ships in the package, so installation alone is enough to plant the implants.
What's Vulnerable
- Vendor: WPManageNinja
- Product: Fluent Forms Pro
- Affected version: 6.2.7 (tampered build)
Sites that obtained 6.2.7 through other distribution channels should still verify the presence or absence of libs/class-license-sync.php and the require_once line in fluentformpro.php.
Patch Status
WPManageNinja has published a security incident notice dated 31 July 2026; operators running 6.2.7 should consult it directly for remediation guidance. Because the implants persist beyond plugin removal, plugin updates alone should not be assumed sufficient; remediation needs to cover the dropped mu-plugins and uploads files, the scheduled tasks, and the rogue administrator account, followed by a credential rotation.