Fluent Forms Pro Tampered Build Backdoor (CVE-2026-73532)

Technical Analysis

The tampered fluentformpro.php adds a require_once call loading libs/class-license-sync.php, a rogue file that registers an unauthenticated backdoor REST API endpoint enabling remote command execution and administrative control. The payload drops additional PHP backdoors into mu-plugins (auto-loaded, hard to disable) and uploads directories, creates a passwordless WordPress administrator account, and registers WP-Cron/system scheduled tasks that re-establish access even after the plugin is uninstalled, giving attackers durable persistence. The CVSS 9.8 rating reflects unauthenticated network-exploitable full compromise (confidentiality, integrity, and availability all critically impacted). Any organization running AI agents or LLM-based automations that interact with a compromised WordPress instance (e.g., agents that manage CMS content, ingest form submissions into RAG pipelines, or use WordPress API keys/credentials for tool calls) faces exposure of those credentials and potential injection of malicious instructions or data into agent workflows via the backdoored REST endpoint.

Affected Systems

WordPress installations running Fluent Forms Pro version 6.2.7 downloaded from the decommissioned/compromised update server; sites with mu-plugins and uploads directories writable by the plugin update process; any environment integrating this plugin's REST API or form data into downstream automation, CRM, or AI agent pipelines.

Indicators of Compromise

• libs/class-license-sync.php
• mu-plugins/*.php (unexpected files added post-update)
• uploads/*.php (unexpected PHP files in media uploads directory)
• Unrecognized passwordless administrator account in wp_users table
• Unexplained scheduled/cron tasks referencing license-sync or update-check routines
• Outbound requests to decommissioned/rogue update server domain (server-specific, verify against known Fluent Forms update endpoints)

Remediation Steps

1. 1

   Immediate isolation and audit

   Take affected sites offline or into maintenance mode; audit wp_users for unauthorized administrator accounts and remove them.

2. 2

   Remove malicious files

   Delete libs/class-license-sync.php, scan and clean mu-plugins and uploads directories for injected PHP backdoors, and remove the require_once reference in fluentformpro.php.

3. 3

   Clear persistence mechanisms

   Inspect and remove rogue WP-Cron entries and any system-level scheduled tasks created by the compromised plugin.

4. 4

   Reinstall from verified source

   Download Fluent Forms Pro only from the official vendor site or WordPress.org repository, verifying checksums/signatures before installation.

5. 5

   Rotate credentials and keys

   Rotate all WordPress admin passwords, API keys, database credentials, and any secrets used by connected AI agents, RAG pipelines, or automation tools that interfaced with the site.

6. 6

   Forensic review and monitoring

   Review server logs for the rogue REST API endpoint usage, deploy file integrity monitoring, and monitor for reinfection or lateral movement.