Cross Site Request Forgery Vulnerability in Fluent Support Pro by WordPress
CVE-2026-78279

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Fluent Support Pro
Vendor
CVE Published:
24 August 2026

What is CVE-2026-78279?

Fluent Support Pro versions up to and including 2.3.1 are susceptible to an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. This flaw allows attackers to exploit the plugin's functionality without requiring user authentication, potentially leading to unauthorized actions performed on behalf of legitimate users. It is crucial for users of affected versions to apply necessary patches and updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Fluent Support Pro <= 2.3.1

References

https://patchstack.com/database/wordpress/plugin/fluent-s...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.