Privilege Escalation Vulnerability in Fluent CRM by WP ManageNinja LLC
CVE-2026-109694

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Fluent Crm
Vendor
CVE Published:
15 October 2026

What is CVE-2026-109694?

An incorrect privilege assignment vulnerability exists in Fluent CRM developed by WP ManageNinja LLC, allowing attackers to escalate their privileges. This security flaw can lead to unauthorized access and manipulation of sensitive data within the application. Versions from n/a up to 3.2.5 are impacted, emphasizing the need for immediate action to secure installations against potential exploits.

Affected Version(s)

Fluent CRM 0 <= 3.2.5

References

https://patchstack.com/database/wordpress/plugin/fluent-c...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.