Access Control Issues in Fluent Support Plugin by WordPress
CVE-2026-14197
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 August 2026
Badges
What is CVE-2026-14197?
The Fluent Support plugin for WordPress prior to version 2.3.1 is susceptible to an access control issue that permits a restricted support agent to modify the customer assigned to any support ticket. This vulnerability arises from the lack of proper access checks during the reassignment process, potentially allowing unauthorized alterations within the ticketing system, even for tickets that fall outside an agent's permitted scope. Organizations using this plugin should update to the latest version promptly to mitigate any security risks.
Affected Version(s)
Fluent Support 0 < 2.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.