EUVD-2026-64786
GHSA-c76f-f8v3-9wj4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered CSRF requires no attacker privileges (PR:N) but mandatory victim interaction (UI:R); limited integrity and confidentiality impact, no scope change or availability loss.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
AnalysisAI
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user authenticated to the target WordPress site with access to Fluent Support Pro (such as a support agent or administrator) actively visits an attacker-controlled web page or resource while their session is valid - this is the mandatory user interaction condition (UI:R) in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.4 (Medium) accurately captures the constrained nature of this CSRF: the attack vector is network (AV:N), complexity is low (AC:L), and no attacker privileges are required (PR:N), but user interaction is mandatory (UI:R), scope is unchanged (S:U), and impact is limited to partial confidentiality and integrity (C:L/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain and hosts a page containing a hidden HTML form or auto-submitting JavaScript that targets a Fluent Support Pro AJAX endpoint - for example, one that modifies ticket assignments or agent settings. The attacker sends a phishing email to a support agent with a compelling pretext (e.g., a fake ticket link); when the agent clicks it while logged into WordPress, their browser silently submits the forged request with their active session cookie, causing the plugin to execute the action under their identity. … |
| Remediation | Update Fluent Support Pro to the version above 2.3.1 released by WP Manageninja LLC - the exact patched version must be confirmed against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fluent-support-pro/vulnerability/wordpress-fluent-support-pro-plugin-2-3-1-cross-site-request-forgery-csrf-vulnerability or the plugin's WordPress.org changelog, as no specific fix version number was provided in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluent Support Pro
View allBroken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1
Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for an
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today