Unauthenticated Profile Field Modification in Fluent Support Helpdesk Plugin by FluentForms

CVE-2026-119213

What is CVE-2026-119213?

The Fluent Support plugin for WordPress contains a vulnerability that allows unauthenticated attackers to modify certain profile fields of registered customers. This occurs when the plugin accepts form submissions from public forms without verifying the submitter's ownership of the associated email address. An attack can enable unauthorized changes to limited customer information, such as first and last names, title, address, and other mapped fields, depending on the administrator's configuration of the feeds. Therefore, it is crucial to ensure that only authenticated users can submit data that may change sensitive customer information.

References