Fluent Support Pro EUVD-2026-64836

Exploitation requires an authenticated WordPress subscriber-level account on the target installation, as confirmed by CVSS PR:L. This is not unauthenticated exploitation. The Fluent Support Pro plugin must be installed, active, and running version 2.3.1 or earlier. On WordPress sites with subscriber self-registration enabled (a common default for support portals), any external party can create an account and immediately exploit the flaw - effectively reducing the real-world barrier. On sites where administrator approval is required for new accounts, an attacker must obtain credentials through other means (phishing, credential stuffing, prior breach). The unchanged scope (S:U) limits impact to the plugin's own data domain; exploitation does not inherently yield access to the broader WordPress site or server. No specific non-default configuration or unusual deployment mode is cited as a prerequisite beyond the plugin being active.

The CVSS 3.1 score of 5.4 Medium is grounded in network-accessible exploitation (AV:N), low attack complexity (AC:L), a required low-privileged subscriber account (PR:L), no user interaction (UI:N), unchanged scope (S:U), and limited confidentiality and integrity impact (C:L/I:L) with no availability impact. No EPSS score is present in the available data, so exploitation probability cannot be numerically quantified. This CVE does not appear in the CISA KEV catalog, and no public proof-of-concept code has been identified. The practical risk is meaningfully shaped by whether the affected WordPress installation permits subscriber self-registration: sites with open registration effectively lower the authentication barrier to near zero, making exploitation straightforward for any external actor, while sites requiring manual account approval significantly constrain who can exploit this flaw. The limited C:L/I:L impact and unchanged scope bound the worst-case outcome to exposure or manipulation of support ticket content rather than full site compromise.

An attacker registers a free subscriber account on a WordPress site running Fluent Support Pro 2.3.1 or earlier - a step requiring no special privileges on sites with open registration. The attacker then sends crafted HTTP requests directly to the plugin's unprotected endpoint, bypassing the authorization check that should restrict access to agent- or admin-level roles, and reads or alters support ticket records. No public exploit code has been confirmed at time of analysis, but the low attack complexity and well-understood WordPress plugin exploitation patterns make independent reproduction straightforward once the specific unprotected endpoint is identified.