CVE-2026-14197: Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fluent Support WordPress pluginto a version that resolves this vulnerability.Fixed in 2.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated restricted support agent can exploit it. The attacker must already have Agent+ access or equivalent high-level support-agent permissions.
Are all tickets potentially affected?
Yes. A restricted agent can reassign the customer of tickets outside that agent’s granted scope, so tickets across the system may be exposed to unauthorized reassignment.
What is the impact of a successful exploit?
An attacker can change which customer is assigned to a ticket. The CVSS vector indicates low confidentiality and integrity impact, with no availability impact.
What should be updated?
Update the Fluent Support WordPress plugin to version 2.3.1 or later. Versions before 2.3.1 are affected.