CVE-2026-78467— Fluent Support Pro <= 2.3.1 - Missing Authorization
Quick assessment
Affected
Fluent Support Fluent Support Pro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Fluent Support Pro 插件存在漏洞，由于某个函数缺少权限检查，导致该漏洞在 2.3.1 及更早的所有版本中均存在。这使得具有 Subscriber 级别及以上权限的认证攻击者可以执行未授权的操作。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78467
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fluent Support Pro <= 2.3.1 - Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Fluent Support | Fluent Support Pro | 0 ~ 2.3.1 | - |
|
II. Public POCs for CVE-2026-78467
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78467
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78467 (1)
IV. Related Vulnerabilities
Same weakness: CWE-862
-
CVE-2026-70550
Potential unauthorized access to private Composer repository -
CVE-2026-69104
Potential unauthorized repository migration in JFrog Artifac -
CVE-2026-55541
PraisonAI: `--api-key` flag on `praisonai serve` is not prop -
CVE-2026-55530
PraisonAI: ast_grep_rewrite rewrites arbitrary files without -
CVE-2026-79672
Ech0 before 4.4.3 Authentication Bypass via Comment Panel
V. Comments for CVE-2026-78467
No comments yet