CVE-2026-78272 WP ManageNinja LLC CVE debrief

Who should care

Defenders and administrators using Fluent Support Pro versions up to 2.3.1 should be aware of this vulnerability and assess their exposure. This includes reviewing the current version in use, evaluating the potential impact on subscriber data, and considering updates or mitigations as necessary.

Why it matters

CVE-2026-78272 is a medium-severity vulnerability affecting Fluent Support Pro versions up to 2.3.1, allowing unauthorized access to subscriber data. Defenders should verify exposure, assess impact, and consider updates or mitigations.

• Verification of exposure in environments using Fluent Support Pro versions up to 2.3.1 is necessary to prevent unauthorized access to subscriber data.
• Defenders should assess the need for updates or mitigations to address this vulnerability.
• Proper authorization and authentication mechanisms for subscriber data handling should be reviewed and ensured.

Technical summary

The CVE-2026-78272 vulnerability is a Subscriber Broken Access Control issue affecting Fluent Support Pro versions up to 2.3.1. This vulnerability has a CVSS score of 5.4 and is considered medium severity. The issue allows for unauthorized access to subscriber data.

Defensive priority

Defenders should prioritize verifying exposure in their environments, especially those using Fluent Support Pro versions up to 2.3.1, and assess the need for updates or mitigations.

Recommended defensive actions

• Verify the version of Fluent Support Pro in use and compare it to the affected versions.
• Assess the exposure of subscriber data and the potential impact of unauthorized access.
• Consider updating to a version of Fluent Support Pro that addresses this vulnerability, if available.
• Review access controls and subscriber data handling to ensure proper authorization and authentication mechanisms are in place.

Evidence notes

The vulnerability is described as a Subscriber Broken Access Control issue in Fluent Support Pro versions up to 2.3.1. The CVSS score is 5.4, indicating a medium severity. The CVE record and NVD entry provide official details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.