{"id":"CVE-2026-109694","published":"2026-10-15T11:17:24.537","lastModified":"2026-10-15T15:17:27.977","description":"Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-crm/vulnerability/wordpress-fluent-crm-plugin-3-2-5-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to escalate their privileges within the Fluent CRM plugin, potentially gaining administrative access to WordPress sites. The flaw occurs due to incorrect privilege assignment during user role management.","exploitability":"Exploitation appears straightforward as it requires no authentication and can be triggered through the plugin's functionality, though specific preconditions like plugin usage patterns are not detailed in the description.","blast_radius":"The impact could be severe across many WordPress sites using Fluent CRM 3.2.5 or earlier, potentially allowing attackers to fully compromise these systems with administrative privileges.","remediation":"Upgrade to version 3.2.6 or later to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","plugin","auth"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:45:48.116Z"}}