Fluent Support EUVD-2026-48504

Exploitation requires the attacker to hold at minimum a contributor-level WordPress account on the target site - unauthenticated or subscriber-level access is insufficient. The shortcode must be placed on a page accessible to potential victims. On the victim side, exploitation is further gated by two concurrent conditions: the victim must be using a browser that processes HTML access key attributes as script triggers (not all browsers do), and the victim must press the specific keyboard access key combination that fires the hidden attribute - this is not a routine browsing action. There is no default-configuration exploitation path; sites that disable open user registration or restrict shortcode use to editors and above are substantially protected. The CVSS PR:L confirms authentication is required from the attacker's side.

The NVD/Wordfence CVSS 3.1 score of 6.4 uses AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The UI:N rating is debatable given the description explicitly requires the victim to press specific access keys in specific browsers - this is user interaction by any reasonable definition. Likewise, AC:L understates the non-default browser and access-key preconditions described. A more conservative independent assessment raises AC to High and UI to Required, reflecting real-world exploitation difficulty. PR:L accurately reflects the contributor-level authentication barrier, which restricts the attacker pool on sites with controlled registration. No EPSS data was provided in the intelligence feed. There is no CISA KEV listing, no public POC, and no known active exploitation. The description's own language - 'making exploitation unlikely' - is an unusually candid concession of low real-world risk by the reporting researcher (Wordfence). Despite the scope-changed (S:C) rating suggesting cross-user impact potential, the realistic threat tier is low: an attacker must already have a contributor account, the payload only activates under narrow browser/access-key conditions, and no weaponized exploit is known.

An attacker who has registered or obtained a contributor-level WordPress account crafts a page or post embedding the Fluent Support shortcode with a malicious JavaScript payload in the 'redirect-to' attribute. The payload persists in the database and is rendered into a hidden HTML attribute on any page where the shortcode is placed. A victim browsing the page in a susceptible browser presses a platform-specific access key (e.g., Alt+letter on certain desktop browsers), inadvertently triggering the hidden attribute's script, which could exfiltrate session cookies or perform actions as the authenticated victim.