CVE-2025-67926
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Fluent Support: from n/a through <= 1.10.4.
Risk Assessment
An attacker can exploit incorrectly configured access control mechanisms to perform unauthorized actions, potentially compromising data confidentiality and integrity. This affects the security of the WordPress site.
Recommendation
Update the Fluent Support plugin to a version newer than 1.10.4 that contains the fix. Review and correct the access control configuration on the site.
Other vulnerabilities in Fluent Support
See all- CVE-2026-65470Medium
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
- CVE-2026-94679Medium
The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.
- CVE-2026-14197Low
The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Original NVD description (English source)
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.10.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS