CVE-2026-94679
MediumCVSS 5.4Summary
The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.
Risk Assessment
A low-privileged user (Subscriber) may access functionality that should be protected, potentially leading to unauthorized operations.
Recommendation
Update the Fluent Support plugin to a version newer than 2.3.2 as soon as a fix becomes available.
Other vulnerabilities in Fluent Support
See all- CVE-2026-65470Medium
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
- CVE-2026-14197Low
The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Original NVD description (English source)
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.