Description

Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-24T12:16:55.193Z",
  "pubdate": "2026-08-24T12:16:55.193Z",
  "executiveSummary": "A broken access control vulnerability has been identified in Fluent Support Pro versions 2.3.1 and prior.\nThis security flaw introduces a significant risk by allowing low-privileged users, specifically those with Subscriber roles, to perform unauthorized actions restricted to higher-privileged administrators or support agents.\nThe vulnerability directly impacts instances running the affected Fluent Support Pro product, potentially compromising the confidentiality, integrity, and availability of the underlying helpdesk system and sensitive support data.\nThe inherent risk implication involves privilege escalation and unauthorized data manipulation within the application context.\nAn attacker possessing standard Subscriber-level capabilities can exploit this security deficiency without requiring complex prerequisites beyond baseline authentication on the target system.\nSuccessful exploitation allows unauthorized manipulation of system functions, highlighting a failure in proper authorization checks and role-based access enforcement within the vulnerable component.",
  "technicalDetails": "The vulnerability stems from insufficient authorization checks within Fluent Support Pro versions <= 2.3.1, specifically failing to adequately validate whether the requesting user possesses the necessary administrative or agent privileges before processing privileged requests.\nAuthentication is required in the sense that the threat actor must hold a valid Subscriber-level account to interact with the vulnerable endpoints.\nHowever, the core issue is a lack of rigorous role-based access control (RBAC) enforcement, allowing low-privileged authenticated users to bypass intended security boundaries.\nThe attack flow typically initiates when a malicious user authenticated with a Subscriber role crafts an HTTP request targeting restricted backend functions or administrative routines within the Fluent Support Pro plugin.\nBecause the underlying codebase fails to verify user capabilities or roles against the requested action, the application processes the request and executes the privileged functionality.\nThis execution path leads to unauthorized data access, modification, or administrative state changes depending on the specific endpoint targeted.\nThe vulnerable component resides within the access validation logic handling administrative or agent-only operations in Fluent Support Pro.\nNetwork exposure encompasses any web-accessible instance running the affected versions, as the endpoints are reachable via standard HTTP/HTTPS protocols utilized by the application.\nPost-exploitation impact includes unauthorized modification of support tickets, potential exposure of sensitive customer data handled by the helpdesk, and broader compromise of helpdesk operational integrity.\nThe root cause is a classic broken access control flaw, characterized by the omission of capability checks (such as current_user_can() equivalents in WordPress environments) prior to executing sensitive code paths."
}