{"id":"CVE-2026-119213","kind":"vulnerability","aliases":["CVE-2026-119213"],"related":[],"title":"Fluent Support WordPress plugin: unauthenticated customer profile overwrite via forms","description":"The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.","summary":"The Fluent Support helpdesk plugin for WordPress, up to and including 2.4.7, lets anyone who submits a public Fluent Forms form overwrite some stored profile fields of an existing customer whose email they supplied. The email, role and status cannot be changed; only name fields with no value set, and address fields an administrator mapped in the feed, can be altered.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluent-forms","fluent-support","package","self-hosted","wordpress"],"not_affected_if":["no-fluentsupport-feed","plugin-not-installed","version-2.4.8-or-later"],"how_to_check":"- Check the installed Fluent Support version in the WordPress plugins screen or `wp plugin get fluent-support --field=version`\n- Look for a FluentSupport feed on public Fluent Forms forms in the form settings","fix":"- Fluent Support: unknown (sources state versions up to and including `2.4.7` are affected, but no fixed version is given)","status":"open","published_at":"2026-11-07T03:17:01+00:00","first_seen_at":"2026-11-07T03:45:33+00:00","triaged_at":"2026-11-07T03:48:07+00:00","updated_at":"2026-11-07T03:48:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T03:48:07Z","model":"claude-haiku-5-5","output":{"fix":"- Fluent Support: unknown (sources state versions up to and including `2.4.7` are affected, but no fixed version is given)","reach":"internet","title":"Fluent Support WordPress plugin: unauthenticated customer profile overwrite via forms","impact":"low","summary":"The Fluent Support helpdesk plugin for WordPress, up to and including 2.4.7, lets anyone who submits a public Fluent Forms form overwrite some stored profile fields of an existing customer whose email they supplied. The email, role and status cannot be changed; only name fields with no value set, and address fields an administrator mapped in the feed, can be altered.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fluent-support","fluent-forms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker overwrites customer name and mapped profile fields","analyst_note":"Confirm the fixed version of Fluent Support after 2.4.7 from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119213.","how_to_check":"- Check the installed Fluent Support version in the WordPress plugins screen or `wp plugin get fluent-support --field=version`\n- Look for a FluentSupport feed on public Fluent Forms forms in the form settings\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-fluentsupport-feed","plugin-not-installed","version-2.4.8-or-later"],"who_is_affected":"Sites running Fluent Support up to and including 2.4.7 where an administrator has attached a FluentSupport feed to a public Fluent Forms form. Sites without that feed configured, or without the plugin, are not exposed through this path. The attack needs no account, but only changes profile fields of existing WordPress users.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000793,"input_tokens":4466,"output_tokens":692,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119213':13A,16A '-2026':12A,15A '2.4.7':39B,119C 'account':152C 'address':78B,164C,209C,238C 'administr':81B,197C,248C 'alter':88B 'anyon':41B 'attack':169C,181C 'attacker-suppli':168C 'cannot':67B 'chang':69B,215C 'citi':239C 'control':162C 'countri':242C 'custom':6A,57B,93C,108C,173C,190C 'cve':11A,14A 'data':171C 'email':59B,63B,147C,157C,208C 'enabl':199C 'exist':56B,150C 'feed':85B,202C,254C 'feedintegr':127C 'field':53B,72B,79B,112C,194C,236C 'first':122C,216C 'first-parti':121C 'fluent':1A,18B,21B,29B,46B,90C,124C 'fluent-form':17B 'fluent-support':20B 'fluentsupport':201C 'form':10A,19B,47B,48B,125C,135C,206C 'get':154C 'helpdesk':31B,92C 'host':26B 'includ':38B,118C 'integr':126C 'last':218C 'let':40B 'limit':185C 'link':107C 'log':141C 'logged-out':140C 'make':176C 'map':82B,250C 'maybecreatecustom':174C 'meta':233C 'modif':104C 'name':71B,219C,229C 'never':214C 'notifi':128C 'open':129C 'overwrit':8A,49B,183C 'overwritten':221C 'packag':23B 'parti':123C 'pass':166C 'plugin':4A,32B,97C 'possibl':178C 'profil':7A,52B,111C,193C 'public':45B,134C,205C 'regist':189C 'resolv':144C 'role':64B,210C 'self':25B 'self-host':24B 'set':76B,186C,230C 'state':240C 'status':66B,212C 'store':51B,110C,192C 'submiss':136C 'submit':43B,146C 'submitt':143C,161C 'suppli':61B,170C 'support':2A,22B,30B,91C,94C 'system':96C 'target':225C 'ticket':95C,131C 'titl':237C 'unauthent':5A,103C,180C 'user':155C,226C,232C 'valu':75B 'verifi':159C 'version':114C 'via':9A,153C 'vulner':101C 'whose':58B 'without':158C 'wordpress':3A,27B,34B,99C,151C 'writabl':244C 'zip':241C","nicknames":[],"mitigations":[],"who_affected":"Sites running Fluent Support up to and including 2.4.7 where an administrator has attached a FluentSupport feed to a public Fluent Forms form. Sites without that feed configured, or without the plugin, are not exposed through this path. The attack needs no account, but only changes profile fields of existing WordPress users.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fluentforms","fluentsupport","low","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119213':13A,16A '-2026':12A,15A 'custom':6A 'cve':11A,14A 'fluent':1A 'form':10A 'overwrit':8A 'plugin':4A 'profil':7A 'support':2A 'unauthent':5A 'via':9A 'wordpress':3A","search_b":"'2.4.7':39B 'address':78B 'administr':81B 'alter':88B 'anyon':41B 'cannot':67B 'chang':69B 'custom':57B 'email':59B,63B 'exist':56B 'feed':85B 'field':53B,72B,79B 'fluent':18B,21B,29B,46B 'fluent-form':17B 'fluent-support':20B 'form':19B,47B,48B 'helpdesk':31B 'host':26B 'includ':38B 'let':40B 'map':82B 'name':71B 'overwrit':49B 'packag':23B 'plugin':32B 'profil':52B 'public':45B 'role':64B 'self':25B 'self-host':24B 'set':76B 'status':66B 'store':51B 'submit':43B 'suppli':61B 'support':22B,30B 'valu':75B 'whose':58B 'wordpress':27B,34B","search_c":"'2.4.7':119C 'account':152C 'address':164C,209C,238C 'administr':197C,248C 'attack':169C,181C 'attacker-suppli':168C 'chang':215C 'citi':239C 'control':162C 'countri':242C 'custom':93C,108C,173C,190C 'data':171C 'email':147C,157C,208C 'enabl':199C 'exist':150C 'feed':202C,254C 'feedintegr':127C 'field':112C,194C,236C 'first':122C,216C 'first-parti':121C 'fluent':90C,124C 'fluentsupport':201C 'form':125C,135C,206C 'get':154C 'helpdesk':92C 'includ':118C 'integr':126C 'last':218C 'limit':185C 'link':107C 'log':141C 'logged-out':140C 'make':176C 'map':250C 'maybecreatecustom':174C 'meta':233C 'modif':104C 'name':219C,229C 'never':214C 'notifi':128C 'open':129C 'overwrit':183C 'overwritten':221C 'parti':123C 'pass':166C 'plugin':97C 'possibl':178C 'profil':111C,193C 'public':134C,205C 'regist':189C 'resolv':144C 'role':210C 'set':186C,230C 'state':240C 'status':212C 'store':110C,192C 'submiss':136C 'submit':146C 'submitt':143C,161C 'suppli':170C 'support':91C,94C 'system':96C 'target':225C 'ticket':95C,131C 'titl':237C 'unauthent':103C,180C 'user':155C,226C,232C 'verifi':159C 'version':114C 'via':153C 'vulner':101C 'without':158C 'wordpress':99C,151C 'writabl':244C 'zip':241C","first_public_at":"2026-11-07T03:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119213","severity":null,"published_at":"2026-11-07T03:17:01+00:00","modified_at":"2026-11-07T03:17:01+00:00","first_seen_at":"2026-11-07T03:45:33+00:00","fetched_at":"2026-11-07T03:45:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}