Threats tagged 'ghsa-q7x6-x924-p7cg'

The Fluent Support plugin for WordPress versions up to and including 2.4.7 has a vulnerability allowing unauthenticated attackers to modify certain stored profile fields of linked customers. This occurs via the plugin's integration with Fluent Forms, where public form submissions can trigger ticket creation and update customer data without verifying email ownership. The vulnerability permits overwriting limited profile fields such as first and last name (only if unset), title, address, city, state, zip, and country, but not email, role, or status.