The vulnerability is an incorrect privilege assignment (CWE-266) in the WordPress Fluent CRM plugin, allowing malicious actors to gain higher level access than intended. This flaw can lead to unauthorized operations and full control over the WordPress site, compromising confidentiality, integrity, and availability for exposed data from the plugin and potentially beyond.

All installations of WordPress Fluent CRM up to version 3.2.5 are affected. The issue applies to every instance of the plugin regardless of the WordPress core version, unless the latest patch has been applied.

The CVSS score of 8.8 categorises the flaw as high severity, yet the EPSS score of less than 1 % indicates that, at present, exploitation is considered unlikely on a large scale. The plugin does not appear in the CISA KEV catalog. Exploitation would likely require a user who can execute plugin code, such as an authenticated administrator or a user with sufficient privileges to install or configure the plugin. Attackers would target the privilege assignment logic to grant themselves administrative rights, but the low EPSS suggests that such attacks are not widespread currently.