CVE-2026-78272 in Fluent Support Pro Plugin
Summary
by MITRE • 08/24/2026
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified as Subscriber Broken Access Control within the Fluent Support Pro plugin, affecting versions up to and including 2.3.1, represents a critical failure in server-side authorization logic that allows unauthorized users to manipulate or access sensitive customer data. This flaw is rooted in the application's inability to properly verify whether the authenticated user initiating an action possesses the requisite permissions for the specific resource being accessed. In typical WordPress environments, plugins often rely on role-based access control mechanisms tied to the core CMS architecture; however, Fluent Support Pro implements custom handling for subscriber records that fails to adequately validate these roles against the requested operation. Consequently, any logged-in user with even minimal privileges, such as a standard customer or low-level support agent, can potentially bypass intended restrictions and perform actions reserved exclusively for administrators or higher-privileged staff members.
From a technical perspective, this broken access control manifests when API endpoints or internal functions responsible for managing subscriber profiles do not enforce strict ownership checks or capability validations before processing requests. An attacker with valid credentials but insufficient privileges can craft specific HTTP requests to modify subscriber details, view private communication histories, or delete support tickets belonging to other users. This is often facilitated by manipulating parameters such as user IDs in POST or PUT requests where the server blindly trusts client-supplied identifiers without cross-referencing them against the current session's authorized scope. The absence of robust middleware checks means that the application processes these maliciously crafted inputs, leading to a complete compromise of data integrity and confidentiality for affected subscriber accounts.
The operational impact of this vulnerability is severe, particularly given the sensitive nature of customer support interactions which often involve personally identifiable information (PII), payment details, or confidential business inquiries. Successful exploitation allows an attacker to escalate privileges within the application context without needing administrative access initially. This can lead to data exfiltration where private subscriber conversations are leaked, unauthorized modification of ticket statuses to hide evidence of malicious activity, or even account takeover scenarios if password reset functions are also improperly secured. For organizations relying on Fluent Support Pro for customer relationship management, this vulnerability undermines trust and compliance with data protection regulations such as GDPR or CCPA, potentially resulting in significant legal and reputational damage due to the exposure of confidential client information.
This issue aligns directly with CWE-284 Improper Access Control, specifically highlighting failures in authorization checks that allow users to act outside their intended permissions. Furthermore, it maps to MITRE ATT&CK techniques related to Privilege Escalation and Collection via Client-side Technologies, as the attacker leverages valid credentials to access data they are not authorized to see. To mitigate this risk, administrators of sites running Fluent Support Pro versions 2.3.1 or earlier must immediately update the plugin to a patched version where these authorization checks have been reinforced. In addition to updating, it is advisable to implement Web Application Firewall rules that monitor for anomalous patterns in subscriber-related API calls and to conduct regular security audits focusing on role-based access control implementations across all custom plugins used within the WordPress ecosystem.