CVE-2026-78279
MediumCVSS 5.4Summary
Unauthenticated CSRF vulnerability in Fluent Support Pro versions up to 2.3.1. An attacker can exploit this to perform unauthorized actions in the context of a logged-in user.
Risk Assessment
Risk of unauthorized changes to support settings or ticket data, potentially leading to confidentiality or integrity breach.
Recommendation
Update the Fluent Support Pro plugin to the latest version that includes the fix.
Other vulnerabilities in Fluent Support Pro
See all- CVE-2026-78272Medium
Broken Access Control vulnerability in Fluent Support Pro versions up to 2.3.1, affecting subscriber role users. Allows unauthorized access to functions or data.
- CVE-2026-78467Medium
The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.