Fluent Support Pro
Monthly
Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for any authenticated subscriber-level user due to a missing capability check on a plugin function. The missing check (CWE-862) means WordPress's built-in role/capability enforcement is bypassed, allowing low-privileged users to invoke functionality reserved for higher-privilege roles. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (any registered user) makes it accessible to a broad attacker pool on sites with open user registration.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for any authenticated subscriber-level user due to a missing capability check on a plugin function. The missing check (CWE-862) means WordPress's built-in role/capability enforcement is bypassed, allowing low-privileged users to invoke functionality reserved for higher-privilege roles. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (any registered user) makes it accessible to a broad attacker pool on sites with open user registration.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.