---
id: "CVE-2026-119213"
page: "https://infrastack.ai/live/CVE-2026-119213"
kind: "vulnerability"
aliases: ["CVE-2026-119213"]
title: "Fluent Support WordPress plugin: unauthenticated customer profile overwrite via forms"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fluent-forms", "fluent-support", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-fluentsupport-feed", "plugin-not-installed", "version-2.4.8-or-later"]
published_at: "2026-11-07T03:17:01+00:00"
first_seen_at: "2026-11-07T03:45:33+00:00"
updated_at: "2026-11-07T03:48:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119213", "first_seen_at": "2026-11-07T03:45:33+00:00"}]
exploit_sources: []
---

# Fluent Support WordPress plugin: unauthenticated customer profile overwrite via forms

Link for people: https://infrastack.ai/live/CVE-2026-119213 (this .md is for agents)

The Fluent Support helpdesk plugin for WordPress, up to and including 2.4.7, lets anyone who submits a public Fluent Forms form overwrite some stored profile fields of an existing customer whose email they supplied. The email, role and status cannot be changed; only name fields with no value set, and address fields an administrator mapped in the feed, can be altered.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Fluent Support version in the WordPress plugins screen or `wp plugin get fluent-support --field=version`
- Look for a FluentSupport feed on public Fluent Forms forms in the form settings

## Fix

- Fluent Support: unknown (sources state versions up to and including `2.4.7` are affected, but no fixed version is given)

## Timeline

- 2026-11-07T03:45:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119213

## From the sources

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_