CVE-2026-109694

CriticalCVSS 9.8

Published: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Summary

The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.

Risk Assessment

The vulnerability could allow takeover of the site or access to CRM customer data. Organizations using Fluent CRM are exposed to privilege escalation.

Recommendation

Update the Fluent CRM plugin to the latest version (above 3.2.5). Check for any unauthorized privilege changes.

Other vulnerabilities in Fluent CRM

CVE-2026-57715High
The Fluent CRM WordPress plugin contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 3.1.7.

Original NVD description (English source)

Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS