Fluent Support Pro vulnerabilities

Unauthenticated CSRF vulnerability in Fluent Support Pro versions up to 2.3.1. An attacker can exploit this to perform unauthorized actions in the context of a logged-in user.

Broken Access Control vulnerability in Fluent Support Pro versions up to 2.3.1, affecting subscriber role users. Allows unauthorized access to functions or data.

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.