{
 "id": "WPSEC-2026-2391",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2391/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2391/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2391/index.md",
 "title": "Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.7 - Authenticated (Support Agent+) Missing Authorization to Arbitrary Plugin Option Update via 'settings_key' Parameter",
 "description": "The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Missing Authorization via the 'settings_key' parameter of the settings save REST endpoint in all versions up to, and including, 2.4.7, due to the endpoint writing the submitted settings to whatever plugin option key the request names, instead of only the settings pages it serves. This makes it possible for authenticated support agents who have been granted the 'Manage Overall Settings' permission (which can be given to users who are not administrators) to overwrite arbitrary Fluent Support options. This includes options that only administrators may change, such as turning on the MCP server for AI agents.",
 "plugin": {
  "slug": "fluent-support",
  "name": "Fluent Support – Helpdesk & Customer Support Ticket System",
  "full_name": "Fluent Support – Helpdesk & Customer Support Ticket System",
  "wordpress_org": "https://wordpress.org/plugins/fluent-support/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-support/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-support"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.5.0",
 "remediation": "Update to 2.5.0 or later.",
 "fix_released": "2026-11-02T14:32:27+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:23:00.396309+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2391/",
  "https://plugins.svn.wordpress.org/fluent-support/tags/2.5.0/",
  "https://wordpress.org/plugins/fluent-support/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-support",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}