CVE-2026-73532

The record

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Affected packages

Related vulnerabilities

• CVE-2026-73533 Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via… CWE-506
• CVE-2026-48160 react-tracked provides state usage tracking with Proxies. CWE-506
• CVE-2026-48159 use-reducer-async is a React useReducer with async actions. CWE-506
• CVE-2026-48158 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18… CWE-506
• CVE-2026-66747 Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present… CWE-506
• CVE-2026-45758 Guardrails AI is a Python framework that helps build AI applications. CWE-506
• GHSA-jpvj-wpmj-h7rv Supply chain compromise via malicious @cap-js/openapi CWE-506
• CVE-2026-48027 Nx Console is the user interface for Nx & Lerna. CWE-506