The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned custome…

Info

CVECVE-2026-14197

First seen2026-08-01 08:16 UTC

Disclosed2026-08-01 07:16 UTC

Last updated2026-08-01 08:16 UTC

Channel statusauto

Summary

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://wpscan.com/vulnerability/cd488221-6efd-42a0-badc-315c60ec0b99/

Timeline

2026-08-01 nvd_ingest NVD