Fluent Support Pro CVE-2026-78467

Exploitation requires a valid WordPress user account with at minimum Subscriber-level role on the target site. This is the primary limiting factor: sites with open user registration (WordPress default allows this) are reachable by any internet user who self-registers, while sites with closed registration limit exposure to already-credentialed insiders or compromised accounts. The vulnerability affects all installations of Fluent Support Pro through 2.3.1 regardless of further plugin configuration - no special plugin feature or non-default setting is required. The specific function and the exact nature of the unauthorized action are not named in available public data, which limits further condition scoping.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-exploitable (AV:N), low-complexity (AC:L) flaw requiring low-privilege authentication (PR:L) with no user interaction, scoped to the vulnerable system, producing low integrity impact and no confidentiality or availability impact. The PR:L metric is the primary limiting signal: exploitation requires at minimum a Subscriber-level WordPress account, which materially reduces risk on sites without open registration. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. No KEV listing and no public POC are present, indicating no confirmed or publicly demonstrated active exploitation at time of analysis. The vague description ('perform an unauthorized action') prevents precise scoping of integrity impact - the actual damage may be higher or lower depending on which function is exposed. This is likely a real but low-urgency issue for most deployments.

An attacker registers a free account on a WordPress site running Fluent Support Pro 2.3.1 or earlier, obtaining Subscriber-level credentials. With those credentials, the attacker directly calls the unprotected plugin function via an authenticated HTTP request, bypassing the expected role-based access control and performing an action normally restricted to support agents or administrators. No public POC has been identified, so the attacker would need to independently discover the vulnerable endpoint through source review or fuzzing.