CVE-2026-109693
8.8HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-266
Impact
Authenticated users with low privileges can escalate their access to take over the WordPress site. An attacker only needs basic network access and a valid low-privilege account.
Root cause
The plugin incorrectly assigns user roles and privileges, allowing unauthorized role modifications.
Affected systems
Fluent CRM through 3.2.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Fluent CRM to a version newer than 3.2.5 once released by WP ManageNinja, or deactivate the plugin immediately if an update is not yet available.
$ wp plugin update fluent-crmAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.