{"id":"CVE-2026-62141","kind":"vulnerability","aliases":["CVE-2026-62141"],"related":[],"title":"Fluent CRM WordPress plugin: missing authorization check exposes data","description":"Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.","summary":"Fluent CRM, a WordPress plugin by WP ManageNinja, has a missing authorization check in affected versions. The sources say an attacker can exploit incorrectly configured access control levels to reach actions they should not.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluent-crm","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Fluent CRM plugin version in the WordPress admin under Plugins, or with `wp plugin get fluent-crm --field=version`\n- Compare the installed version against the range in the sources (through 3.2.6)","fix":"- Fluent CRM: fixed version unknown from sources (affected range ends at 3.2.6)","status":"open","published_at":"2026-10-30T16:17:58+00:00","first_seen_at":"2026-10-30T16:31:27+00:00","triaged_at":"2026-10-30T16:32:24+00:00","updated_at":"2026-10-30T16:32:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T16:32:24Z","model":"claude-haiku-5-5","output":{"fix":"- Fluent CRM: fixed version unknown from sources (affected range ends at 3.2.6)","reach":"internet","title":"Fluent CRM WordPress plugin: missing authorization check exposes data","impact":"medium","summary":"Fluent CRM, a WordPress plugin by WP ManageNinja, has a missing authorization check in affected versions. The sources say an attacker can exploit incorrectly configured access control levels to reach actions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","fluent-crm","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized actions on CRM data within the WordPress site","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and the exact unauthorized actions and required role.","how_to_check":"- Check the installed Fluent CRM plugin version in the WordPress admin under Plugins, or with `wp plugin get fluent-crm --field=version`\n- Compare the installed version against the range in the sources (through 3.2.6)","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Fluent CRM WordPress plugin at version 3.2.6 or earlier. The sources say the flaw is in access control configuration, so sites that restrict CRM roles tightly may be less exposed, but the sources do not say which configurations are safe. unknown whether a default install is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4127,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62141':12A,15A '3.2.6':82C 'access':49B,71C 'action':54B 'affect':38B,76C 'allow':67C 'attack':44B 'author':6A,35B,56C 'check':7A,36B 'configur':48B,70C 'control':50B,72C 'crm':2A,18B,25B,63C,66C,78C 'cve':10A,13A 'data':9A 'exploit':46B,68C 'expos':8A 'fluent':1A,17B,24B,62C,65C,77C 'fluent-crm':16B,64C 'host':22B 'incorrect':47B,69C 'issu':75C 'level':51B 'levels.this':74C 'llc':61C 'manageninja':31B,60C 'miss':5A,34B,55C 'n/a':80C 'packag':19B 'plugin':4A,28B 'reach':53B 'say':42B 'secur':73C 'self':21B 'self-host':20B 'sourc':41B 'version':39B 'vulner':57C 'wordpress':3A,23B,27B 'wp':30B,59C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Fluent CRM WordPress plugin at version 3.2.6 or earlier. The sources say the flaw is in access control configuration, so sites that restrict CRM roles tightly may be less exposed, but the sources do not say which configurations are safe. unknown whether a default install is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62141","severity":null,"published_at":"2026-10-30T16:17:58+00:00","modified_at":"2026-10-30T16:17:58+00:00","first_seen_at":"2026-10-30T16:31:27+00:00","fetched_at":"2026-10-30T16:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}