{"id":"CVE-2026-119213","aliases":["EUVD-2026-118562","GHSA-q7x6-x924-p7cg"],"status":"published","title":"Fluent Support \u003c= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed","description":"The Fluent Support – Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00225,"percentile":0.13254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-11-07T02:29:15Z","modified":"2026-11-07T03:31:17Z","products":[{"vendor":"techjewel","product":"fluent support – helpdesk \u0026 customer support ticket system"},{"vendor":"wpmanageninja","product":"fluent support – helpdesk \u0026 customer support ticket system"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aea4f76-053d-4ce4-ae8c-7c01d7727718?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Services/Integrations/FluentForm/FeedIntegration.php#L358"},{"url":"https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Services/Integrations/FluentForm/FeedIntegration.php#L335"},{"url":"https://plugins.trac.wordpress.org/browser/fluent-support/tags/2.4.5/app/Models/Customer.php#L126"},{"url":"https://wordpress.org/plugins/fluent-support/"},{"url":"https://plugins.trac.wordpress.org/changeset/3780020/fluent-support/trunk/app/Services/Integrations/FluentForm/FeedIntegration.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119213"},{"url":"https://wordpress.org/plugins/fluent-support"},{"url":"https://github.com/advisories/GHSA-q7x6-x924-p7cg"}],"sources":{"cve":[{"id":"CVE-2026-119213","title":"Fluent Support \u003c= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed","description":"The Fluent Support – Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.","status":"published","published":"2026-11-07T02:29:15.139Z","modified":"2026-11-08T19:05:25.099Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-07T03:32:21.038338Z"}],"euvd":[{"id":"EUVD-2026-118562","description":"The Fluent Support – Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.","status":"published","published":"2026-11-07T02:29:15Z","modified":"2026-11-08T19:05:25Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-07T06:08:32.207523Z"}],"ghsa":[{"id":"GHSA-q7x6-x924-p7cg","title":"The Fluent Support – Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable...","description":"The Fluent Support – Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.","status":"published","published":"2026-11-07T03:31:10Z","modified":"2026-11-07T03:31:17Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-639"],"updated_at":"2026-11-07T03:35:32.541373Z"}],"nvd":[{"id":"CVE-2026-119213","description":"The Fluent Support – Helpdesk \u0026 Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.","status":"published","published":"2026-11-07T03:17:01.62Z","modified":"2026-11-08T19:17:35.147Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-08T22:11:13.443661Z"}]}}