CVE-2026-78467
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Risk Assessment
Unauthorized access can allow an attacker to perform actions they are not permitted to, potentially leading to data integrity issues or privilege escalation.
Recommendation
Update the Fluent Support Pro plugin to a version newer than 2.3.1 and audit logs for unauthorized actions.
Other vulnerabilities in Fluent Support Pro
See all- CVE-2026-78279Medium
Unauthenticated CSRF vulnerability in Fluent Support Pro versions up to 2.3.1. An attacker can exploit this to perform unauthorized actions in the context of a logged-in user.
- CVE-2026-78272Medium
Broken Access Control vulnerability in Fluent Support Pro versions up to 2.3.1, affecting subscriber role users. Allows unauthorized access to functions or data.
Original NVD description (English source)
The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.