CVE-2026-78279

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Published Aug 24, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

Analysis

Technical impact

The vulnerability is an unauthenticated Cross Site Request Forgery flaw present in all releases of the Fluent Support Pro plugin through version 2.3.1. It allows an unauthenticated attacker to send crafted requests that the plugin will accept and execute as if they came from an authorized user, potentially altering the state of the plugin or the website without needing credentials. The impact is limited to the scope of actions the plugin supports, but it can compromise the integrity of the site by modifying data the plugin handles.

Affected Systems

WordPress sites that have installed WP ManageNinja LLC’s Fluent Support Pro plugin with version 2.3.1 or earlier.

Risk and Exploitability

The CVSS score of 5.4 rates this flaw as moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is a web‑based CSRF where an unauthenticated user is tricked into visiting a crafted page that submits a forged request to the vulnerable plugin.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WP ManageNinja LLC

Fluent Support Pro

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 2.3.1

No data.

Vendor Product Versions

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Wpmanageninja

Fluent Support

Version	Status	Scheme	Platform
`[0,2.3.1]`	affected	semver	—
`[2.3.2,*]`	unaffected	semver	—

Remediation

Vendor Solution

Update the WordPress Fluent Support Pro Plugin to the latest available version (at least 2.3.2).

OpenCVE Recommended Actions

Update the Fluent Support Pro plugin to version 2.3.2 or later.
If an update is not possible immediately, temporarily disable or uninstall the plugin to stop potential exploitation.
Stay informed of vendor advisories and apply future security patches once available.

Generated by OpenCVE AI on August 24, 2026 at 12:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.132% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/fluent-support-pro/vulnerability/wordpress-fluent-support-pro-plugin-2-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

History

Aug 24, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wpmanageninja Wpmanageninja fluent Support
Vendors & Products		Wordpress Wordpress wordpress Wpmanageninja Wpmanageninja fluent Support

Aug 24, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 11:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
Title		WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Weaknesses		CWE-352
References		https://patchstack.com/database/wordpress/plugin/fluent-support-pro/vulnerability/wordpress-fluent-support-pro-plugin-2-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}`