EUVD-2026-51722
GHSA-vprj-v253-jvjv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint but requires authenticated support agent account (PR:H); limited confidentiality and integrity impact from ticket reassignment only, no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
AnalysisAI
Broken object-level authorization in Fluent Support WordPress plugin before 2.3.1 allows restricted support agents to reassign the customer field on any ticket system-wide, bypassing per-ticket scope enforcement. Affected are WordPress installations running Fluent Support versions prior to 2.3.1 where restricted support agent accounts exist. An authenticated agent can manipulate ticket ownership across the entire helpdesk, exposing customer metadata and corrupting ticket assignment integrity. A publicly available proof-of-concept exists; EPSS probability is very low (0.13%, 3rd percentile) and no CISA KEV listing indicates no confirmed mass exploitation.
Technical ContextAI
Fluent Support is a WordPress-native helpdesk and customer support ticketing plugin. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR class flaw where the plugin exposes a ticket mutation endpoint that accepts a ticket identifier as a user-controlled parameter but fails to verify that the requesting agent is authorized to operate on that specific ticket before executing the customer reassignment. The WordPress plugin architecture allows role-based agent scoping, but this scope check was absent on the reassignment code path. The CPE string (cpe:2.3:a:unknown:fluent_support:*:*:*:*:*:*:*:*) reflects all versions prior to 2.3.1 as affected; the vendor identifier field is unresolved in NVD at time of analysis.
RemediationAI
Update Fluent Support to version 2.3.1 or later, which introduces per-ticket access checks before customer reassignment. This is the primary and recommended remediation, confirmed by the WPScan advisory at https://wpscan.com/vulnerability/cd488221-6efd-42a0-badc-315c60ec0b99/. If an immediate upgrade is not feasible, a compensating control is to audit and minimize the number of accounts holding restricted support agent roles, reducing the exposed attack surface - note this does not eliminate the flaw but narrows the pool of accounts that could abuse it. Additionally, WordPress administrators can temporarily restrict the ticket reassignment capability at the application or WAF level by blocking the relevant AJAX action endpoint if identifiable, though this may disrupt legitimate agent workflows. No workarounds eliminate the underlying IDOR; patching to 2.3.1 is the only confirmed fix.
More in Fluent Support
View allThe Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters befo
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Fl
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPManageNinja LLC
The Fluent Support - Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Informati
Stored Cross-Site Scripting in Fluent Support (WordPress plugin by WPManageNinja) versions up to and including 2.3.0 all
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Confi
Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for an
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today