This vulnerability in the WordPress Fluent CRM plugin is caused by an incorrect privilege assignment that permits a user with lower privileges to elevate their access level. The flaw allows the attacker to perform actions normally reserved for administrators, such as modifying or deleting CRM data, and potentially gaining control over the entire WordPress site. The weakness is categorized as CWE‑266, indicating a flaw in privilege management.

The flaw affects all installations of the Fluent CRM plugin from the earliest version through 3.2.5. WordPress sites that have deployed the plugin in any of those versions are susceptible. The vulnerability is triggered when a user interacts with the plugin’s functionality, and it is not limited to a specific operating system or environment beyond the typical WordPress PHP stack.

The CVSS score for this issue is 9.8, reflecting the serious impact of privilege escalation. However, the EPSS score is below 1%, suggesting that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, which may limit public awareness of active exploitation. Based on the description, it is inferred that an attacker would need authenticated access to a WordPress account that has the ability to interact with the Fluent CRM plugin, after which the incorrect privilege assignment can be exploited to obtain higher privileges.