Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.7 - Authenticated (Support Agent+) Missing Authorization to Arbitrary Plugin Option Update via 'settings_key' Parameter
- ID
- WPSEC-2026-2391
- Plugin
- Fluent Support – Helpdesk & Customer Support Ticket System (fluent-support)
- Affected
- all versions before 2.5.0
- Remediation
- Update to 2.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- Fluent Support – Helpdesk & Customer Support Ticket System on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Missing Authorization via the 'settings_key' parameter of the settings save REST endpoint in all versions up to, and including, 2.4.7, due to the endpoint writing the submitted settings to whatever plugin option key the request names, instead of only the settings pages it serves. This makes it possible for authenticated support agents who have been granted the 'Manage Overall Settings' permission (which can be given to users who are not administrators) to overwrite arbitrary Fluent Support options. This includes options that only administrators may change, such as turning on the MCP server for AI agents.
References
- https://wpsec.com/vuln/WPSEC-2026-2391/
- https://plugins.svn.wordpress.org/fluent-support/tags/2.5.0/
- https://wordpress.org/plugins/fluent-support/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS