CVE-2026-78467: Fluent Support Pro Auth Bypass Vulnerability

CVE-2026-78467 Overview

CVE-2026-78467 affects the Fluent Support Pro plugin for WordPress. The plugin contains a missing capability check on a function in all versions up to and including 2.3.1. Authenticated attackers with Subscriber-level access or above can perform an unauthorized action. The vulnerability is categorized as broken access control [CWE-862] and stems from insufficient authorization enforcement on a plugin function exposed to low-privileged users.

Critical Impact
Authenticated users with minimal Subscriber-level privileges can invoke a protected function in Fluent Support Pro and perform actions beyond their intended authorization boundary, resulting in limited integrity impact.

Affected Products

Fluent Support Pro plugin for WordPress, all versions up to and including 2.3.1
WordPress sites where Subscriber-level or higher registration is enabled
Any WordPress deployment bundling Fluent Support Pro at or below the vulnerable version

Discovery Timeline

2026-08-25 - CVE-2026-78467 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78467

Vulnerability Analysis

The vulnerability resides in the Fluent Support Pro plugin, a helpdesk and ticketing extension for WordPress. A plugin function accessible over the network lacks a current_user_can() capability check before executing its logic. Any authenticated session, including one belonging to a Subscriber, can reach the function and trigger its side effects.

The issue is classified under CWE-862: Missing Authorization. The attack requires authentication but no user interaction, and the exploit path traverses the network. Integrity impact is limited, while confidentiality and availability are unaffected according to the published CVSS vector.

WordPress sites that permit open user registration are the primary exposure surface. In those configurations, an unauthenticated attacker can self-provision a Subscriber account and immediately meet the authentication precondition. Details are documented in the Wordfence Vulnerability Report.

Root Cause

The root cause is a missing authorization check inside a plugin function. The function assumes callers hold appropriate helpdesk privileges but does not verify capabilities or roles before performing its action. WordPress plugins must gate privileged handlers with explicit capability checks and, for AJAX or REST endpoints, nonce verification.

Attack Vector

An attacker authenticates as a Subscriber and issues a request to the vulnerable plugin endpoint. Because the handler runs without verifying the caller's capabilities, the action succeeds regardless of the user's assigned role. No specialized tooling is required beyond an authenticated HTTP client. See the Fluent Support Official Site for product context.

No verified public exploit code is available at this time. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-78467

Indicators of Compromise

Requests to Fluent Support Pro AJAX or REST endpoints originating from accounts that hold only the Subscriber role.
Unexpected changes to helpdesk tickets, agents, or plugin settings performed by non-agent users.
Spikes in new Subscriber registrations followed shortly by plugin endpoint activity from those accounts.

Detection Strategies

Review WordPress access logs for admin-ajax.php or wp-json requests referencing Fluent Support actions and correlate with the initiating user's role.
Audit user registration events and match them against subsequent plugin endpoint calls to identify probing behavior.
Enable WordPress action logging or a security plugin to record capability-relevant operations performed by low-privileged users.

Monitoring Recommendations

Monitor web server logs for authenticated POST requests to Fluent Support Pro endpoints from users lacking helpdesk roles.
Alert on anomalous helpdesk record modifications outside normal agent working hours.
Track the installed Fluent Support Pro version across managed WordPress sites to identify hosts still running 2.3.1 or earlier.

How to Mitigate CVE-2026-78467

Immediate Actions Required

Update Fluent Support Pro to a version later than 2.3.1 as soon as the vendor publishes a patched release.
Temporarily disable open user registration on WordPress sites that do not require it.
Audit existing Subscriber accounts and remove any that were not legitimately provisioned.

Patch Information

Refer to the Fluent Support Official Site and the Wordfence Vulnerability Report for the fixed version and vendor-supplied remediation guidance. Apply the patched release to all WordPress installations running Fluent Support Pro 2.3.1 or earlier.

Workarounds

Disable the Fluent Support Pro plugin until a fixed version is installed if the helpdesk functionality is not business-critical.
Restrict access to wp-admin and admin-ajax.php at the web server or WAF layer for unauthenticated and low-privileged users where feasible.
Set the WordPress users_can_register option to false to prevent attackers from self-provisioning Subscriber accounts.

bash

# Configuration example: disable open registration via wp-cli
wp option update users_can_register 0

# Deactivate the vulnerable plugin until patched
wp plugin deactivate fluent-support-pro