Fluent CRM EUVD-2026-114129

Exploitation requires a valid authenticated account on the target WordPress site (CVSS PR:L), so the attacker must already be a registered user; it is not exploitable by fully unauthenticated visitors. The flaw lies in Fluent CRM's access-control enforcement (missing authorization, CWE-862) rather than in a specific opt-in feature, so default installations of versions up to 3.2.6 appear affected. No user interaction is needed (UI:N). The available sources do not name the exact endpoint, parameter, or role boundary that is crossed, so the specific action a low-privilege user can perform is not described in the input; the requirement to hold a valid low-privilege account is the principal factor limiting real-world exploitation.

This is a moderate, authentication-gated access-control flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) describes a network-reachable, low-complexity issue requiring low-level privileges (PR:L) - i.e. an authenticated account - with limited confidentiality and integrity impact and no availability impact. CWE-862 (Missing Authorization) aligns with the description of incorrectly configured access-control levels, meaning an authenticated low-privilege user can likely reach functionality or data intended for higher roles. No EPSS score, KEV listing, or SSVC exploitation metrics were provided in the input, so probabilistic and active-exploitation signals are absent and cannot be weighed. The only reference is the Patchstack advisory that reported the issue; no working exploit code is indicated. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent priority. Net: a genuine broken-access-control bug worth patching in a normal cycle, not a drop-everything event, with the main unknowns being real-world exploitation probability (EPSS absent) and the exact privilege level and endpoint required.

An attacker who already holds a low-privilege authenticated account on a WordPress site running Fluent CRM up to 3.2.6 (for example a subscriber or other registered user) sends requests to a plugin endpoint that fails to properly enforce authorization. Because of the missing authorization check, they are able to access or modify CRM data or actions that should be restricted to higher-privileged roles. No public working exploit code is indicated in the sources, and exploitation requires a valid account, which limits opportunistic abuse.