The Fluent Support Pro WordPress plugin contains a missing capability check in a function, allowing authenticated attackers with Subscriber-level privileges or above to execute unauthorized actions. This vulnerability affects all versions up to and including 2.3.1. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and impacts integrity without affecting confidentiality or availability. No known exploits are reported in the wild, and no vendor advisory or patch information is available at this time.

Authenticated users with Subscriber-level access or higher can perform unauthorized actions due to the lack of proper authorization checks. This could lead to integrity violations within the affected system. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to minimize exposure and monitor for unusual activity related to Fluent Support Pro plugin functions.