CVE-2026-14197 — Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to chang…
Published: 2026-08-01 · CVSS: 3.8 · CVSS 3.1
The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7