CVE-2026-109694

Summary

This vulnerability allows attackers to escalate their privileges within the Fluent CRM plugin, potentially gaining administrative access to WordPress sites. The flaw occurs due to incorrect privilege assignment during user role management.

Exploitability

Exploitation appears straightforward as it requires no authentication and can be triggered through the plugin's functionality, though specific preconditions like plugin usage patterns are not detailed in the description.

Blast radius

The impact could be severe across many WordPress sites using Fluent CRM 3.2.5 or earlier, potentially allowing attackers to fully compromise these systems with administrative privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.2.6 or later to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.