CVE-2024-5053

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it possible for Form Managers with a Subscriber-level access and above to modify the Mailchimp API key used for integration. At the same time, missing Mailchimp API key validation allows the redirect of the integration requests to the attacker-controlled server.

We have discovered 6,793 live websites that are affected by CVE-2024-5053.

Run a Free Instant Scan



Affected Software

Product  Fluentform
Category Wordpress Plugins
Vulnerable Domains6,793 live websites (7.76% of Fluentform install base)
Vulnerable Versions
  • from 0 through 5.1.18
Vulnerable Versions Count57 versions ( 58% of all versions)


Common Weakness Enumeration

CWE-285 Improper Authorization



Details

  • Published - Sep 1, 2024
  • Updated - Apr 8, 2026

Credits

  • Tobias Weißhaar (finder)

Website Distribution by Country

Number of websites using CVE-2024-5053
United States1,694 websites


Germany686 websites
France475 websites
GB388 websites
India220 websites
Poland201 websites
Italy199 websites
Brazil165 websites
Australia162 websites
Russia155 websites

Website Distribution by TLD

Number of websites using CVE-2024-5053
.com2,752 websites
.de341 websites
.org294 websites
.co.uk232 websites
.fr156 websites
.pl156 websites
.com.au154 websites
.com.br149 websites
.net140 websites
.it139 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-5053

Top websites that are affected by CVE-2024-5053. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********************.com United States**,***
************.com Indonesia**,***
**********.com United States**,***
*******.com United States**,***
**************.com United States**,***
******************.com United States**,***
***.ci United States**,***
***********.com United States***,***
***********.com United States***,***
*******.com Singapore***,***
See full domain list

FAQ

CVE-2024-5053 is Improper Authorization in Fluentform
A total of 6,793 websites have been identified as vulnerable to CVE-2024-5053, based on global website indexing conducted by WebTechSurvey.
The Fluentform is affected by the CVE-2024-5053 vulnerability.
Fluentform versions up to and including 5.1.18 are vulnerable to CVE-2024-5053.