Quick answers
- Is CVE-2026-14197 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14197 being exploited in the wild.
- How severe is CVE-2026-14197?
- Informational severity, with a CVSS score of 3.8, published 1 August 2026.
- Which products and versions are affected?
- WPManageNinja Fluent Support < 2.3.1.
- Is there a fix for CVE-2026-14197?
- A patch was published on 2026-07-17: Fixed in version 2.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-14197 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14197?
- Check whether you run WPManageNinja Fluent Support at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Fluent Support plugin for WordPress prior to version 2.3.1. The issue is located in the REST API endpoint responsible for changing a ticket's customer (`/wp-json/fluent-support/v2/tickets/{id}/change-customer`), which fails to validate if the authenticated agent has permission to access or modify the specific ticket ID provided. An attacker with low-privileged 'Agent' credentials can send a PUT request to this endpoint to reassign any ticket to an arbitrary customer ID. This bypasses intended scope restrictions where agents should only see or manage tickets assigned to them. The vulnerability was addressed in version 2.3.1.
Affected products
- WPManageNinja Fluent Support < 2.3.1
Timeline
- 2026-07-17: disclosed: Initial disclosure by WPScan
- 2026-07-17: patched: Fixed in version 2.3.1
- 2026-08-01: advisory: NVD publication date