Description
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
Published: 2026-08-24
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Support Functionality
Action: Update Plugin
AI Analysis

Impact

The flaw is a broken access control in the WordPress Fluent Support Pro plugin version 2.3.1 and earlier, allowing a user to manipulate support tickets and related data without proper authorization. This vulnerability is classified under CWE‑862, meaning it permits users lacking sufficient privileges to perform restricted actions, potentially leading to confidentiality or integrity violations within the support system.

Affected Systems

The affected product is the WordPress plugin Fluent Support Pro from WP ManageNinja LLC. Versions up to and including 2.3.1 are impacted; any release prior to 2.3.2 remains vulnerable.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation data. Attackers who can log in as a standard subscriber or obtain a subscriber‑level account may exploit the missing authorization checks to access or modify tickets, thereby gaining unauthorized control over support interactions.

Generated by OpenCVE AI on August 24, 2026 at 12:52 UTC.

Remediation

Vendor Solution

Update the WordPress Fluent Support Pro Plugin to the latest available version (at least 2.3.2).

OpenCVE Recommended Actions

  • Apply the latest version of the Fluent Support Pro plugin (at least 2.3.2).
  • Review and tighten WordPress user roles to restrict support ticket access to administrators only.
  • Monitor ticket activity logs for unauthorized or anomalous changes and investigate promptly.

Generated by OpenCVE AI on August 24, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpmanageninja
Wpmanageninja fluent Support
Vendors & Products Wordpress
Wordpress wordpress
Wpmanageninja
Wpmanageninja fluent Support

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
Title WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Wordpress Wordpress
Wpmanageninja Fluent Support
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-24T12:51:10.682Z

Reserved: 2026-08-24T07:37:56.725Z

Link: CVE-2026-78272

cve-icon Vulnrichment

Updated: 2026-08-24T12:50:11.730Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T12:16:55.193

Modified: 2026-08-24T16:40:53.647

Link: CVE-2026-78272

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:45:04Z

Weaknesses