CVE-2026-94679
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Fluent Support plugin in versions up to and including 2.3.2 contains a Broken Access Control vulnerability exploitable by a Subscriber-level user. The flaw involves improper access control on plugin functionality.
Risk Assessment
A low-privileged user (Subscriber) may access functionality that should be protected, potentially leading to unauthorized operations.
Recommendation
Update the Fluent Support plugin to a version newer than 2.3.2 as soon as a fix becomes available.
Other vulnerabilities in Fluent Support
See all- CVE-2026-14197Low
The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.
- CVE-2026-65470Medium
The Fluent Support plugin version 2.3.0 and earlier is vulnerable to XSS attacks from a contributor role. A user with contributor privileges can inject a malicious script.
- CVE-2025-67926Medium
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Fluent Support: from n/a through <= 1.10.4.
Original NVD description (English source)
Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS