# Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Insecure Direct Object Reference to Restricted Mailbox Tickets via 'on_behalf' Customer Portal Parameter

- **ID:** WPSEC-2026-0796
- **Plugin:** Fluent Support – Helpdesk & Customer Support Ticket System (`fluent-support`), https://wordpress.org/plugins/fluent-support/
- **Affected versions:** from 1.7.80 before 2.4.5
- **Fixed in:** 2.4.5 (Update to 2.4.5 or later.)
- **Severity:** Low 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-support
- **Fix released:** 2026-10-09
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0796/

## Description

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'on_behalf' parameter of the Customer Portal REST endpoints in versions 1.7.80 to 2.4.0, due to the portal not checking that the acting agent may access the ticket or mailbox involved. This makes it possible for authenticated support agents who hold the sensitive-data and manage-all-tickets permissions but are restricted from certain mailboxes to view, list, reply to, close and create tickets in those restricted mailboxes by acting on behalf of the ticket's customer.

## References

- https://wpsec.com/vuln/WPSEC-2026-0796/
- https://plugins.svn.wordpress.org/fluent-support/tags/2.4.5/
- https://wordpress.org/plugins/fluent-support/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0796/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.