CVE-2026-119213
Deferred Deferred - Pending Action

Unauthenticated Profile Field Modification in Fluent Support WordPress Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-119213
EUVD
EUVD-2026-118562

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmanageninja Fluent Support – Helpdesk & Customer Support Ticket System From 0 (inc) to 2.4.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Fluent Support WordPress plugin allows unauthenticated attackers to modify certain stored profile fields of registered customers. The issue occurs when a public form submission triggers a ticket creation, and the plugin resolves the submitter's email to an existing WordPress account without verifying ownership. Attackers can then overwrite limited profile fields like first name, last name, title, address, city, state, zip, and country if an administrator has enabled a FluentSupport feed on the form.

Detection Guidance

Check WordPress sites using Fluent Support plugin versions up to 2.4.7. Inspect form submissions for unauthorized profile field modifications. Review user meta changes for first/last name, title, address, city, state, zip, or country where feeds are enabled.

Impact Analysis

If you use the Fluent Support plugin, attackers could alter customer profile data such as names, addresses, or other custom fields. This could lead to misinformation in customer records, potential confusion in support interactions, or reputational damage. The email address, role, and status of users remain unchanged, limiting the scope of impact.

Compliance Impact

The vulnerability could impact GDPR compliance by allowing unauthorized modification of personal data (e.g., names, addresses) stored in customer profiles. Since Fluent Support is self-hosted and GDPR-compliant by design, this flaw introduces a risk of data integrity breaches. HIPAA compliance may also be affected if protected health information is stored in the plugin and altered without authorization.

Mitigation Strategies

Update Fluent Support plugin to the latest version. Disable public forms with FluentSupport feeds. Audit user profiles for unauthorized changes. Monitor for suspicious ticket submissions from public forms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119213. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...