Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.5 - Authenticated (Support Agent+) Sensitive Information Exposure via Contact Search
- ID
- WPSEC-2026-1607
- Plugin
- Fluent Support – Helpdesk & Customer Support Ticket System (fluent-support)
- Affected
- all versions before 2.4.7
- Remediation
- Update to 2.4.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-25
- Attack surface
- Fluent Support – Helpdesk & Customer Support Ticket System on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure via the contact search REST endpoint in all versions up to, and including, 2.4.5. This is due to partial name and email searches of customers and FluentCRM contacts being allowed without the 'Access Private Data' (fst_sensitive_data) permission that the Customers list requires, and to the WordPress user lookup not excluding support staff or administrators. This makes it possible for authenticated support agents with ticket management permission, but without access to private data, to enumerate customer names and email addresses and to look up the email addresses of WordPress users, including administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-1607/
- https://plugins.svn.wordpress.org/fluent-support/tags/2.4.7/
- https://wordpress.org/plugins/fluent-support/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS