# Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.7 - Authenticated (Support Agent+) Missing Authorization to Arbitrary Plugin Option Update via 'settings_key' Parameter

- **ID:** WPSEC-2026-2391
- **Plugin:** Fluent Support – Helpdesk & Customer Support Ticket System (`fluent-support`), https://wordpress.org/plugins/fluent-support/
- **Affected versions:** all versions before 2.5.0
- **Fixed in:** 2.5.0 (Update to 2.5.0 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-support
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2391/

## Description

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Missing Authorization via the 'settings_key' parameter of the settings save REST endpoint in all versions up to, and including, 2.4.7, due to the endpoint writing the submitted settings to whatever plugin option key the request names, instead of only the settings pages it serves. This makes it possible for authenticated support agents who have been granted the 'Manage Overall Settings' permission (which can be given to users who are not administrators) to overwrite arbitrary Fluent Support options. This includes options that only administrators may change, such as turning on the MCP server for AI agents.

## References

- https://wpsec.com/vuln/WPSEC-2026-2391/
- https://plugins.svn.wordpress.org/fluent-support/tags/2.5.0/
- https://wordpress.org/plugins/fluent-support/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2391/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.