CVE-2026-14197: Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR

Q: Who can exploit this issue?

An authenticated restricted support agent can exploit it. The attacker must already have Agent+ access or equivalent high-level support-agent permissions.

Q: Are all tickets potentially affected?

Yes. A restricted agent can reassign the customer of tickets outside that agent’s granted scope, so tickets across the system may be exposed to unauthorized reassignment.

Q: What is the impact of a successful exploit?

An attacker can change which customer is assigned to a ticket. The CVSS vector indicates low confidentiality and integrity impact, with no availability impact.

Q: What should be updated?

Update the Fluent Support WordPress plugin to version 2.3.1 or later. Versions before 2.3.1 are affected.

Published Aug 1, 2026

Updated

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.

Affected Software

1 affected component

Fluent Support Fluent Support WordPress plugin<2.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fluent Support WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.3.1

Event History

Aug 1, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated restricted support agent can exploit it. The attacker must already have Agent+ access or equivalent high-level support-agent permissions.

Are all tickets potentially affected?

Yes. A restricted agent can reassign the customer of tickets outside that agent’s granted scope, so tickets across the system may be exposed to unauthorized reassignment.

What is the impact of a successful exploit?

An attacker can change which customer is assigned to a ticket. The CVSS vector indicates low confidentiality and integrity impact, with no availability impact.

What should be updated?

Update the Fluent Support WordPress plugin to version 2.3.1 or later. Versions before 2.3.1 are affected.

CVE-2026-14197: Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are all tickets potentially affected?

What is the impact of a successful exploit?

What should be updated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are all tickets potentially affected?

What is the impact of a successful exploit?

What should be updated?