CVE-2026-14197
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Risk Assessment
Risk of confidentiality and integrity breach of support tickets, and potential disclosure of customer data.
Recommendation
Update the Fluent Support plugin to version 2.3.1 or later.
Other vulnerabilities in Fluent Support
See all- CVE-2026-65470Medium
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
- CVE-2026-94679Medium
The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.
- CVE-2025-67926Medium
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Fluent Support: from n/a through <= 1.10.4.
Original NVD description (English source)
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS