A critical flaw in Cloud Storage Manager for Fluent Forms can let unauthenticated attackers write files outside its intended download folder. Wordfence’s November 14 advisory identifies CVE-2026-120522, rates it 9.8 and lists versions through 1.2.0 as affected.
The issue combines missing authorization on connection-saving and download interfaces with inadequate validation of filenames returned by Google Drive. An attacker-controlled cloud connection and file can therefore produce a write beyond the expected directory.
Code execution is a possible consequence when a PHP file reaches a web-accessible location. The advisory does not report active exploitation.
Wordfence recommends version 1.2.5 or a newer patched release. The developer’s published changelog records API-level security hardening in 1.2.5; the directory currently lists 1.2.9. Administrators should check the installed version and apply an available patched update.
