CVE-2026-109693
HighCVSS 8.8Summary
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation. This issue affects Fluent CRM: from n/a through 3.2.5.
Risk Assessment
An attacker can escalate privileges to access functions reserved for higher roles, potentially leading to site takeover. This may compromise confidentiality, integrity, and availability.
Recommendation
Update the Fluent CRM plugin to a version later than 3.2.5. Review user roles and permissions to detect unauthorized changes.
Other vulnerabilities in Fluent CRM
See all- CVE-2026-109694Critical
The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.
- CVE-2026-57715High
The Fluent CRM WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 3.1.7.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS