{"id":"CVE-2026-62056","kind":"vulnerability","aliases":["CVE-2026-62056"],"related":[],"title":"Fluent CRM WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.","summary":"Fluent CRM, a WordPress marketing and CRM plugin by WP ManageNinja LLC, has a missing authorization check in versions through 3.2.6. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluent-crm","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Fluent CRM plugin version in the WordPress admin under Plugins, or with `wp plugin get fluent-crm --field=version`\n- Compare the result against the fixed version, which the sources do not state","fix":null,"status":"open","published_at":"2026-10-30T19:18:31+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:35+00:00","updated_at":"2026-10-30T19:26:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Fluent CRM WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"Fluent CRM, a WordPress marketing and CRM plugin by WP ManageNinja LLC, has a missing authorization check in versions through 3.2.6. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fluent-crm","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted CRM functions and data","analyst_note":"Find the vendor advisory or Wordfence record to confirm the fixed version, the affected roles, and the endpoints involved.","how_to_check":"- Check the installed Fluent CRM plugin version in the WordPress admin under Plugins, or with `wp plugin get fluent-crm --field=version`\n- Compare the result against the fixed version, which the sources do not state\n- unknown for any further check, as the sources do not say which endpoints or roles are affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Fluent CRM WordPress plugin at version 3.2.6 or earlier are in the affected range, per NVD. The sources do not say which roles or endpoints are affected, or which configurations expose them. Sites that do not run the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4127,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62056':13A,16A '3.2.6':45B,88C 'access':9A,55B,77C 'affect':82C 'allow':73C 'attack':50B 'author':6A,40B,62C 'check':7A,41B 'configur':54B,76C 'control':10A,56B,78C 'crm':2A,19B,26B,31B,69C,72C,84C 'cve':11A,14A 'exploit':52B,74C 'expos':8A 'fluent':1A,18B,25B,68C,71C,83C 'fluent-crm':17B,70C 'function':60B 'host':23B 'incorrect':53B,75C 'issu':81C 'level':57B 'levels.this':80C 'llc':36B,67C 'manageninja':35B,66C 'market':29B 'miss':5A,39B,61C 'n/a':86C 'packag':20B 'plugin':4A,32B 'reach':59B 'say':48B 'secur':79C 'self':22B 'self-host':21B 'sourc':47B 'version':43B 'vulner':63C 'wordpress':3A,24B,28B 'wp':34B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Fluent CRM WordPress plugin at version 3.2.6 or earlier are in the affected range, per NVD. The sources do not say which roles or endpoints are affected, or which configurations expose them. Sites that do not run the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62056","severity":null,"published_at":"2026-10-30T19:18:31+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}