Fluent Support Pro CVE-2026-78279

Exploitation requires that a user authenticated to the target WordPress site with access to Fluent Support Pro (such as a support agent or administrator) actively visits an attacker-controlled web page or resource while their session is valid - this is the mandatory user interaction condition (UI:R) in the CVSS vector. The Fluent Support Pro plugin must be installed and active on the target WordPress site at version 2.3.1 or earlier. No authentication is required of the attacker (PR:N). Exploitation is limited by: (1) the requirement to social-engineer a specific victim who is simultaneously authenticated to the target site, (2) the plugin being a premium paid product reducing the universe of installations compared to free plugins, and (3) the impact being scoped to actions permitted by the victim's account role within the support system.

The NVD CVSS 3.1 score of 5.4 (Medium) accurately captures the constrained nature of this CSRF: the attack vector is network (AV:N), complexity is low (AC:L), and no attacker privileges are required (PR:N), but user interaction is mandatory (UI:R), scope is unchanged (S:U), and impact is limited to partial confidentiality and integrity (C:L/I:L/A:N). Real-world risk depends heavily on what actions the CSRF-vulnerable endpoint controls - if it targets privileged operations such as agent management, ticket reassignment, or configuration changes, the business impact could exceed what the score implies. No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation. No POC has been identified. The primary risk-reduction factor is the mandatory victim interaction: an attacker must successfully social-engineer an authenticated Fluent Support Pro user (support agent or admin) into visiting a malicious page during an active session, which limits automation and mass targeting compared to a fully unauthenticated exploit.

An attacker registers a domain and hosts a page containing a hidden HTML form or auto-submitting JavaScript that targets a Fluent Support Pro AJAX endpoint - for example, one that modifies ticket assignments or agent settings. The attacker sends a phishing email to a support agent with a compelling pretext (e.g., a fake ticket link); when the agent clicks it while logged into WordPress, their browser silently submits the forged request with their active session cookie, causing the plugin to execute the action under their identity. No POC has been identified at time of analysis.