Fluent Support CVE-2026-14197

Exploitation requires an active, authenticated account holding at least a restricted support agent role within the target WordPress installation running Fluent Support. The attacker must be able to authenticate to the WordPress admin or support interface - unauthenticated exploitation is not possible given PR:H in the CVSS vector. The flaw is triggered specifically when the ticket customer reassignment feature is used, meaning the Fluent Support plugin must be installed, activated, and in active use with agent roles provisioned. The limiting factors are: valid support agent credentials are required (not publicly accessible), no automation is confirmed viable (SSVC Automatable:No), and impact is confined to ticket metadata manipulation - no code execution, file access, or privilege escalation to admin is implied.

The CVSS base score of 3.8 (Low) reflects the realistic constrained impact: the attack vector is network (AV:N), complexity is low (AC:L), but high privileges are required (PR:H), meaning the attacker must already hold a support agent account. EPSS at 0.13% (3rd percentile) corroborates the low exploitation probability despite the POC being publicly available - the SSVC assessment concurs: Automatable:No and Technical Impact:Partial. The combination of required authenticated access, restricted scope of impact (ticket reassignment only, no RCE or data exfiltration), and no KEV listing places this firmly in a 'monitor and patch on next cycle' category rather than emergency response. The primary real-world risk is insider threat or compromised agent credential scenarios, not opportunistic internet-scale exploitation. The low EPSS despite POC availability aligns with the PR:H prerequisite reducing attacker pool.

An attacker who has obtained or registered a restricted support agent account on a target WordPress site running Fluent Support below 2.3.1 sends a crafted HTTP request to the ticket reassignment endpoint, supplying the ID of a ticket outside their granted scope. A publicly available proof-of-concept demonstrates this technique. Because no additional conditions are required beyond holding a support agent role, the exploit is straightforward for any insider or attacker with compromised agent credentials.