{
 "id": "WPSEC-2026-0796",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0796/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0796/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0796/index.md",
 "title": "Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Insecure Direct Object Reference to Restricted Mailbox Tickets via 'on_behalf' Customer Portal Parameter",
 "description": "The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'on_behalf' parameter of the Customer Portal REST endpoints in versions 1.7.80 to 2.4.0, due to the portal not checking that the acting agent may access the ticket or mailbox involved. This makes it possible for authenticated support agents who hold the sensitive-data and manage-all-tickets permissions but are restricted from certain mailboxes to view, list, reply to, close and create tickets in those restricted mailboxes by acting on behalf of the ticket's customer.",
 "plugin": {
  "slug": "fluent-support",
  "name": "Fluent Support – Helpdesk & Customer Support Ticket System",
  "full_name": "Fluent Support – Helpdesk & Customer Support Ticket System",
  "wordpress_org": "https://wordpress.org/plugins/fluent-support/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-support/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-support"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.7.80",
    "from_inclusive": true,
    "to": "2.4.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.7.80 before 2.4.5"
  ]
 },
 "introduced_in": "1.7.80",
 "fixed_in": "2.4.5",
 "remediation": "Update to 2.4.5 or later.",
 "fix_released": "2026-10-09T15:31:16+00:00",
 "published": "2026-10-12T11:49:14+00:00",
 "updated": "2026-10-12T11:06:45.286606+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0796/",
  "https://plugins.svn.wordpress.org/fluent-support/tags/2.4.5/",
  "https://wordpress.org/plugins/fluent-support/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-support",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-12"
 }
}