Search

Find a vulnerability

Search criteria

    1 vulnerability found for Fluent Support by Unknown

    CVE-2026-14197 (GCVE-0-2026-14197)

    Vulnerability from cvelistv5 – Published: 2026-08-01 06:00 – Updated: 2026-08-01 06:00
    VLAI
    Title
    Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR
    Summary
    The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/cd488221-6efd-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Fluent Support Affected: 0 , < 2.3.1 (semver)
    		Create a notification for this product.
    Credits
    Mustafa Ahmed WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fluent Support",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mustafa Ahmed"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fluent Support  WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket\u0027s customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-01T06:00:08.528Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/cd488221-6efd-42a0-badc-315c60ec0b99/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Fluent Support \u003c 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-14197",
    "datePublished": "2026-08-01T06:00:08.528Z",
    "dateReserved": "2026-06-30T09:06:09.451Z",
    "dateUpdated": "2026-08-01T06:00:08.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}