Fluent Support CVE-2026-94679

Requires an authenticated WordPress account at Subscriber level (PR:L) on a site running Fluent Support ≤2.3.2; in practice this means the target site must allow user self-registration for a remote attacker to obtain the account, otherwise an existing low-privilege account is needed. No user interaction is required (UI:N) and the flaw is network-reachable (AV:N) with low attack complexity (AC:L). Impact is limited to partial unauthorized read and modification of helpdesk data (C:L/I:L); there is no availability impact. The specific vulnerable endpoint, action, or parameter is not named in the provided data.

Signals point to a low-to-moderate, non-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a remotely reachable but authenticated flaw requiring only low privileges (Subscriber - the lowest self-registerable WordPress role), with limited confidentiality and integrity impact and no availability impact. CWE-862 (Missing Authorization) is consistent with the 'Broken Access Control' description: a low-privilege user can reach helpdesk functionality they should not. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization - exploitation status is 'no public exploit identified at time of analysis.' The main real-world gating factor is that the site must allow user registration (Subscriber accounts) for a remote attacker to self-provision the required PR:L; on sites with open registration this lowers the bar meaningfully, but the capped C:L/I:L impact keeps overall risk modest. The input Tags label this 'Authentication Bypass,' which conflicts with CWE-862 (broken authorization, not authentication bypass) - treat the tag as mislabeled. Affected version data is coarse ('n/a ≤2.3.2') and no fixed version is stated, so patch guidance cannot be confirmed from the provided data.

On a Fluent Support site that permits open user registration, an attacker registers a Subscriber account, authenticates, and invokes a helpdesk endpoint that omits a capability/ownership check, letting them read or alter support-ticket data belonging to other users or staff. No public exploit code was identified, and the impact is bounded to partial disclosure and partial modification (C:L/I:L) with no service disruption.