Critical Vulnerability in WPManageNinja Fluent Forms Pro Affects Version 6.2.7

## Overview CVE-2026-73532 affects WPManageNinja Fluent Forms Pro version 6.2.7. This vulnerability arises from a malicious code embedded in a tampered plugin build. The compromised build was served through a decommissioned update server. ## Technical Details The attack introduces a rogue PHP file located at libs/class-license-sync.php. This file is loaded via a require_once directive added to fluentformpro.php. The malicious code establishes a backdoor REST API endpoint. It also drops persistent PHP files in the mu-plugins and uploads directories. Furthermore, it installs a passwordless administrator account and registers scheduled tasks that persist even after the plugin is removed. ## Impact The presence of this vulnerability allows attackers to gain unauthorized administrative access. The backdoor API endpoint can be exploited to execute arbitrary commands. This can lead to further compromise of the affected systems, data breaches, and potential service disruptions. The CVSS score of 9.3 indicates a critical level of severity, making immediate action necessary for affected users. ## Mitigation Defenders should immediately update to the latest version of WPManageNinja Fluent Forms Pro to mitigate this vulnerability. If the plugin cannot be updated, users should remove it entirely from their systems. Additionally, conduct a thorough review of the system for any unauthorized changes or files. Implement monitoring for unusual activity, especially related to REST API endpoints and scheduled tasks.