Fluent CRM CVE-2026-109694

The target must run the Fluent CRM plugin for WordPress at any version from the initial release through 3.2.5. The flaw is an incorrect privilege assignment (CWE-266) enabling privilege escalation; the input vector claims no authentication or user interaction is required, but the privilege-escalation nature strongly suggests the attacker may need a low-privileged authenticated WordPress account as the starting point - this is the key limiting factor to confirm. The supplied description provides no specific feature, configuration setting, or deployment mode as a precondition, so exploitation appears tied to the plugin's default presence rather than a non-default option; the exact vulnerable endpoint and privilege prerequisite are not detailed in the available data.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 Critical and describes a fully remote, unauthenticated, low-complexity attack with no user interaction yielding high confidentiality, integrity, and availability impact. However, there is a notable internal conflict: the vulnerability class is CWE-266 Incorrect Privilege Assignment resulting in Privilege Escalation, which by definition implies an actor escalating FROM some existing (typically low) privilege level, yet the vector asserts PR:N (unauthenticated). This tension is common in Patchstack-sourced WordPress plugin entries and should be verified - if a low-privileged authenticated account (e.g., subscriber) is actually required, real-world risk is meaningfully lower than the 9.8 suggests. No EPSS score, SSVC decision data, KEV listing, or public POC was provided, so exploitation probability and automatability cannot be quantified from the input; exploitation status is 'no public exploit identified at time of analysis.' Net: treat as a high-priority patch for any site running Fluent CRM given the privilege-escalation-to-full-compromise outcome, but the true priority hinges on whether authentication is genuinely required - resolve the PR:N versus privilege-escalation-semantics conflict with the Patchstack advisory before assuming trivial unauthenticated takeover.

An attacker interacts with the Fluent CRM plugin on a target WordPress site (version 3.2.5 or earlier) and abuses an incorrect privilege assignment to grant themselves elevated capabilities, escalating to administrator-level control over the site. Given the network attack vector and low complexity, the request can likely be scripted against exposed WordPress installs; no public exploit code is identified at time of analysis, so weaponization effort is presently unknown.