CVE-2026-109694: Incorrect Privilege Assignment in WP ManageNinja LLC Fluent CRM

The vulnerability CVE-2026-109694 in Fluent CRM arises from incorrect privilege assignment, enabling an attacker to escalate privileges within the application. This affects all versions from the initial release through 3.2.5. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided in the input data.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to gain elevated privileges within the Fluent CRM plugin, potentially leading to full compromise of the application data and operations. The high CVSS score indicates critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to privilege escalation attempts.