Answer in brief
CVE-2026-120522 records a Critical severity (CVSS 9.8) vulnerability in Cloud Storage Manager for Fluent Forms <= 1.2.0 - Unauthenticated Arbitrary File Write via Google Drive Filename Path Traversal. The current sources do not mark it as known exploited. The current feed maps fluentwiz/Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps fluentwiz/Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| fluentwiz/Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploadsgeneric | >=0 <=1.2.0 | Not reported |
Published upstream
Nov 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 14, 2026
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the `connection/{driver}/save` and `/download/single-file` REST endpoints, combined with insufficient path validation in the Google Drive `downloadFile()` function, where the Google Drive metadata `name` value is concatenated into a local path without `basename()`, `sanitize_file_name()`, or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended `downloads` directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.
Quoted source text, attributed separately from HOL analysis.