Fluent CRM CVE-2026-109693

Exploitation requires an authenticated WordPress account on a site running the Fluent CRM plugin version 3.2.5 or earlier (PR:L - a low-privileged user such as a subscriber/registered user, not an anonymous visitor). The flaw is an Incorrect Privilege Assignment (CWE-266) in the plugin's capability handling, so the practical prerequisite is that the target site both runs the vulnerable Fluent CRM version and permits the attacker to hold or self-register a low-level account (common on sites with open registration or membership features). Limiting factors: exploitation is NOT anonymous (some valid low-privilege credential or registration is needed) and requires the vulnerable plugin to be installed and active; no user interaction is required (UI:N) and no non-default configuration is named in the advisory. The description does not identify the exact vulnerable endpoint, action, or feature, so the specific request required could not be extracted from the provided data.

This is a genuine priority, not a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity privilege escalation requiring only a low-privileged authenticated account (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact - consistent with CWE-266 (Incorrect Privilege Assignment), where a low-privileged WordPress user can elevate toward administrator. The signals are internally consistent: CVSS vector aligns with the description (authenticated privilege escalation). However, several real-risk signals are MISSING from the input: no EPSS exploitation-probability score was provided, the vulnerability is NOT in CISA KEV, no public POC was indicated, and no SSVC decision data was supplied - so exploitation status is 'no public exploit identified at time of analysis.' The practical risk driver is that WordPress plugins with many installed sites are attractive automated targets once a POC emerges, and the low bar (any subscriber/author-level account on a site allowing registration) makes post-disclosure exploitation plausible. Net: treat as a high-priority patch for any internet-facing Fluent CRM site that permits non-admin user accounts, while noting that current exploitation evidence is absent rather than confirmed.

An attacker who holds or registers a low-privileged account (e.g., subscriber) on a WordPress site running Fluent CRM ≤ 3.2.5 sends an authenticated request that abuses the plugin's incorrect privilege assignment to grant themselves elevated capabilities, effectively escalating to administrator-level control of the site. No user interaction or victim action is required, and attack complexity is low. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE rather than a confirmed POC.