CVE-2026-78272: Fluent Support Pro Auth Bypass Vulnerability

CVE-2026-78272 Overview

CVE-2026-78272 is a broken access control vulnerability [CWE-862] affecting the Fluent Support Pro WordPress plugin in versions up to and including 2.3.1. The flaw allows authenticated users with only Subscriber-level privileges to access functionality that should be restricted to higher-privileged roles. The issue stems from missing authorization checks on plugin endpoints, enabling low-privileged users to read or modify data outside their intended scope.

Critical Impact
Authenticated Subscriber accounts can bypass access controls in Fluent Support Pro, leading to limited disclosure and modification of support-desk data on affected WordPress sites.

Affected Products

Fluent Support Pro WordPress plugin versions <= 2.3.1
WordPress sites permitting Subscriber-level registration with the plugin active
Support-desk workflows managed through Fluent Support Pro

Discovery Timeline

2026-08-24 - CVE-2026-78272 published to the National Vulnerability Database
2026-08-24 - Last updated in the NVD database

Technical Details for CVE-2026-78272

Vulnerability Analysis

The vulnerability is a Broken Access Control issue categorized under [CWE-862] Missing Authorization. Fluent Support Pro exposes plugin actions that fail to verify whether the requesting user holds the required capability. As a result, any authenticated user, including one with the default WordPress Subscriber role, can invoke those actions over the network.

Because WordPress Subscriber accounts are frequently created through open registration or comment workflows, the attacker barrier is low. Successful exploitation permits limited unauthorized read and write operations against plugin-managed resources, such as support tickets or agent metadata. Availability is not affected, and no user interaction is required beyond an authenticated session.

The CVSS vector confirms a network attack path against a single scope, with limited impact to confidentiality and integrity. See the Patchstack Vulnerability Report for the coordinated advisory.

Root Cause

The root cause is missing capability checks on plugin endpoints. Handlers likely rely on authentication (is_user_logged_in) or nonce validation without also calling current_user_can against a privileged capability. Without a capability gate, WordPress treats any logged-in role as authorized to execute the action.

Attack Vector

An attacker registers or obtains a Subscriber account on a vulnerable WordPress site. The attacker then issues authenticated HTTP requests to Fluent Support Pro AJAX or REST endpoints that lack authorization checks. The plugin executes the requested action and returns data or applies changes that should be limited to support agents or administrators.

The vulnerability is described in prose only because no verified proof-of-concept code is published. Refer to the vendor advisory for endpoint specifics.

Detection Methods for CVE-2026-78272

Indicators of Compromise

Authenticated HTTP requests from Subscriber accounts to Fluent Support Pro AJAX handlers under /wp-admin/admin-ajax.php with plugin-specific action parameters
REST API calls to Fluent Support Pro routes originating from non-agent user IDs
Unexpected changes to support tickets, agent assignments, or plugin settings made by low-privileged accounts

Detection Strategies

Review WordPress access logs for admin-ajax.php and REST requests correlated to accounts with the Subscriber role
Enable plugin and user-activity auditing to record ticket reads, edits, and configuration changes with the acting user ID
Alert on newly registered accounts that interact with Fluent Support Pro endpoints within a short window of registration

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics pipeline for role-versus-endpoint correlation
Track baseline request patterns for Fluent Support Pro endpoints and alert on deviations by user role
Monitor for enumeration of ticket identifiers or bulk API calls from a single low-privileged session

How to Mitigate CVE-2026-78272

Immediate Actions Required

Update Fluent Support Pro to a version later than 2.3.1 once the vendor patch is applied
Audit existing WordPress user accounts and remove unused Subscriber-level users
Disable open user registration if not required for site operations
Review Fluent Support Pro ticket and configuration history for unauthorized modifications

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply the plugin update through the WordPress admin dashboard or via WP-CLI, and validate that the plugin reports a version above 2.3.1 after the upgrade.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and Fluent Support Pro REST routes at the web application firewall for non-agent roles
Temporarily deactivate the Fluent Support Pro plugin if patching cannot be performed and support-desk workflows can pause
Set users_can_register to false in WordPress settings to prevent unauthenticated attackers from provisioning Subscriber accounts

bash

# Configuration example
wp plugin update fluent-support-pro
wp option update users_can_register 0
wp user list --role=subscriber --fields=ID,user_login,user_registered