Executive brief
Fluent Support is a WordPress plugin used by businesses to manage customer support tickets. A security flaw allows support staff with restricted permissions to modify tickets they are not authorized to access. Specifically, an agent could reassign any ticket in the system to a different customer, potentially disrupting support operations and causing data integrity issues within the helpdesk.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Fluent Support plugin for WordPress prior to version 2.3.1. The issue is located in the REST API endpoint responsible for changing a ticket's customer (`/wp-json/fluent-support/v2/tickets/{id}/change-customer`), which fails to validate if the authenticated agent has permission to access or modify the specific ticket ID provided. An attacker with low-privileged 'Agent' credentials can send a PUT request to this endpoint to reassign any ticket to an arbitrary customer ID. This bypasses intended scope restrictions where agents should only see or manage tickets assigned to them. The vulnerability was addressed in version 2.3.1.
Affected products
- WPManageNinja Fluent Support < 2.3.1
Timeline
- 2026-07-17: disclosed: Initial disclosure by WPScan
- 2026-07-17: patched: Fixed in version 2.3.1
- 2026-08-01: advisory: NVD publication date