Description

Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-24T12:16:55.657Z",
  "pubdate": "2026-08-24T12:16:55.657Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability has been identified in Fluent Support Pro versions up to and including 2.3.1. This security flaw allows unauthenticated attackers to trick authenticated users into executing unauthorized state-changing actions via forged HTTP requests. The impact of successful exploitation includes unauthorized administrative actions or data modification within the affected WordPress plugin depending on the targeted endpoints. The risk implication is significant as it leverages the trust relationship between a legitimate user's browser and the web application. The attacker capabilities involve crafting and delivering malicious links or embedded content via external websites or phishing vectors. Exploitation requirements typically necessitate that a privileged user is authenticated to the vulnerable WordPress instance and interacts with the attacker-controlled resource while an active session exists. Mitigation requires updating the plugin to a patched version once available or implementing strict request validation mechanisms.",
  "technicalDetails": "The vulnerability resides in the request handling mechanisms of Fluent Support Pro versions <= 2.3.1, specifically lacking proper anti-CSRF tokens such as nonces on sensitive state-changing endpoints. The root cause is the absence of verification checks to ensure that incoming HTTP requests originate from legitimate user interactions within the application interface rather than arbitrary external domains. The affected component involves the request processing logic of the plugin where administrative or functional routines are invoked without validating the origin or intent of the request. The network exposure is public, as any web application utilizing the vulnerable plugin is susceptible to browser-based attack vectors. Authentication and privilege requirements for the victim involve holding an active authenticated session with appropriate permissions within the WordPress environment, whereas the attacker requires zero authentication credentials, hence classified as unauthenticated CSRF. The attack flow begins when an attacker crafts a malicious HTML page or script containing an automated form submission, an image tag, or a JavaScript fetch request targeting a sensitive function within the Fluent Support Pro plugin. The attacker then induces the victim, who has an active session on the target WordPress site, to visit the malicious resource. Upon rendering, the victim's browser automatically includes relevant session cookies and credentials in the cross-origin request directed at the vulnerable application. Because the application fails to validate anti-CSRF tokens, it processes the forged request as a legitimate action initiated by the user. The payload behavior executes unauthorized operations, leading to unintended state changes. Post-exploitation impact encompasses the manipulation of support tickets, unauthorized configuration modifications, or execution of privileged routines within the scope of the victim's user privileges."
}