{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119213","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-10-29T16:14:50.099Z","datePublished":"2026-11-07T02:29:15.139Z","dateUpdated":"2026-11-07T02:29:15.139Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-11-07T02:29:15.139Z"},"affected":[{"vendor":"wpmanageninja","product":"Fluent Support – Helpdesk & Customer Support Ticket System","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.4.7","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed."}],"title":"Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aea4f76-053d-4ce4-ae8c-7c01d7727718?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Services/Integrations/FluentForm/FeedIntegration.php#L358"},{"url":"https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Services/Integrations/FluentForm/FeedIntegration.php#L335"},{"url":"https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Models/Customer.php#L126"},{"url":"https://wordpress.org/plugins/fluent-support/"},{"url":"https://plugins.trac.wordpress.org/changeset/3780020/fluent-support/trunk/app/Services/Integrations/FluentForm/FeedIntegration.php"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-639 Authorization Bypass Through User-Controlled Key","cweId":"CWE-639","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW"}}],"credits":[{"lang":"en","type":"finder","value":"Santh"}],"timeline":[{"time":"2026-10-29T16:32:55.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-11-06T13:47:32.000Z","lang":"en","value":"Disclosed"}]}}}