{"id":"CVE-2026-109693","published":"2026-10-15T13:17:12.190","lastModified":"2026-10-16T15:17:08.103","description":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-crm/vulnerability/wordpress-fluent-crm-plugin-3-2-5-privilege-escalation-vulnerability-2?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers with lower privileges to escalate their access to higher privilege levels within the Fluent CRM plugin, potentially enabling them to gain full administrative control over WordPress sites using this plugin.","exploitability":"Exploitation requires a user with existing access to the WordPress site who can interact with the Fluent CRM plugin, making it moderately difficult to exploit without prior access.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full administrative privileges across affected WordPress sites, potentially leading to complete compromise of those systems.","remediation":"Upgrade to Fluent CRM version 3.2.6 or later to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-18T15:55:21.348Z"}}