CVE-2026-94679: Fluent Support Auth Bypass Vulnerability

CVE-2026-94679 Overview

CVE-2026-94679 is a broken access control vulnerability in the Fluent Support WordPress plugin affecting versions up to and including 2.3.2. The flaw allows authenticated users with subscriber-level privileges to access functionality that should be restricted to higher-privileged roles. The weakness is classified under [CWE-862] Missing Authorization, indicating the plugin fails to enforce capability checks on sensitive actions. Attackers who register a low-privilege account can leverage the flaw over the network to read or modify data outside their authorization scope.

Critical Impact
Authenticated subscribers can bypass access controls in Fluent Support to interact with restricted plugin functionality, resulting in limited confidentiality and integrity impact.

Affected Products

Fluent Support WordPress plugin
Versions 2.3.2 and earlier
WordPress sites permitting subscriber-level registration

Discovery Timeline

2026-09-23 - CVE-2026-94679 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94679

Vulnerability Analysis

The vulnerability resides in the Fluent Support plugin, a customer support ticketing system for WordPress. The plugin exposes endpoints or actions that lack proper authorization checks. An authenticated user holding only the default subscriber role can invoke these actions and interact with data or operations that should be restricted to agents or administrators.

The attack requires network access to the WordPress site and a valid low-privilege session. No user interaction is required beyond issuing the authenticated request. The scope is unchanged, meaning the flaw does not cross a security boundary into other components, but it does expose plugin-managed support data.

Because Fluent Support handles customer tickets, the exposed functionality may include ticket contents, conversation threads, or ticket state changes. See the Patchstack Vulnerability Report for the specific advisory details.

Root Cause

The root cause is missing authorization enforcement [CWE-862]. The plugin registers actions or AJAX handlers that verify authentication (a valid logged-in user) but fail to verify capabilities (whether the user holds an appropriate role such as edit_posts or a plugin-specific agent capability). This gap allows any registered user to reach restricted functionality.

Attack Vector

An attacker first obtains a subscriber account, either through open registration or credential compromise. The attacker then sends crafted HTTP requests to the vulnerable Fluent Support endpoints. Because the plugin does not validate the caller's role, the requests execute successfully and return or modify data the subscriber should not access.

No verified proof-of-concept code is publicly available for this issue. The vulnerability mechanism is described in prose based on the advisory classification.

Detection Methods for CVE-2026-94679

Indicators of Compromise

Unexpected HTTP POST or GET requests from subscriber accounts to Fluent Support endpoints such as /wp-admin/admin-ajax.php with fluent_support action parameters
Support ticket records accessed, modified, or created by user IDs that do not correspond to assigned support agents
Anomalous spikes in authenticated requests to plugin routes from low-privilege sessions

Detection Strategies

Review WordPress access logs for authenticated requests to Fluent Support endpoints originating from subscriber-role accounts
Enable plugin and site audit logging to record capability checks, ticket reads, and ticket state transitions
Correlate WordPress user role assignments against activity in support ticket tables to identify privilege mismatches

Monitoring Recommendations

Alert on any subscriber account issuing requests to Fluent Support AJAX or REST routes
Monitor for bulk registration events followed shortly by API calls to plugin endpoints
Track modifications to the wp_fluent_support database tables and attribute them to originating user roles

How to Mitigate CVE-2026-94679

Immediate Actions Required

Update the Fluent Support plugin to a version later than 2.3.2 as soon as the vendor releases a patched build
Audit existing WordPress user accounts and remove unused or unrecognized subscriber registrations
Restrict new user registration on public-facing WordPress sites where subscriber signup is not required

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed version guidance. Apply plugin updates through the WordPress admin dashboard or via WP-CLI once available.

Workarounds

Temporarily disable the Fluent Support plugin if patching is not immediately possible and the ticketing functionality can be paused
Restrict access to /wp-admin/admin-ajax.php and Fluent Support REST routes at the web application firewall (WAF) for requests originating from subscriber sessions
Disable open user registration by unchecking "Anyone can register" under WordPress general settings

bash

# Disable open registration and update the plugin via WP-CLI
wp option update users_can_register 0
wp plugin update fluent-support