{
 "id": "WPSEC-2026-1607",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1607/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1607/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1607/index.md",
 "title": "Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.5 - Authenticated (Support Agent+) Sensitive Information Exposure via Contact Search",
 "description": "The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure via the contact search REST endpoint in all versions up to, and including, 2.4.5. This is due to partial name and email searches of customers and FluentCRM contacts being allowed without the 'Access Private Data' (fst_sensitive_data) permission that the Customers list requires, and to the WordPress user lookup not excluding support staff or administrators. This makes it possible for authenticated support agents with ticket management permission, but without access to private data, to enumerate customer names and email addresses and to look up the email addresses of WordPress users, including administrators.",
 "plugin": {
  "slug": "fluent-support",
  "name": "Fluent Support – Helpdesk & Customer Support Ticket System",
  "full_name": "Fluent Support – Helpdesk & Customer Support Ticket System",
  "wordpress_org": "https://wordpress.org/plugins/fluent-support/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-support/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-support"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.7",
 "remediation": "Update to 2.4.7 or later.",
 "fix_released": "2026-10-23T14:08:10+00:00",
 "published": "2026-10-24T14:40:40+00:00",
 "updated": "2026-10-24T10:53:05.973023+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1607/",
  "https://plugins.svn.wordpress.org/fluent-support/tags/2.4.7/",
  "https://wordpress.org/plugins/fluent-support/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-support",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-25"
 }
}