CVE-2026-109694
9.8CriticalPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-266
Impact
Unauthenticated remote attackers can escalate privileges to take over the WordPress site over the network. They do not need prior authentication or user interaction to exploit it.
Root cause
The plugin incorrectly assigns user privileges, allowing unauthorized users to gain elevated permissions.
Affected systems
Fluent CRM through 3.2.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Fluent CRM to a version newer than 3.2.5 once available. If an update cannot be applied immediately, deactivate the Fluent CRM plugin in WordPress to block exploitation.
$ wp plugin update fluent-crmAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.