Fluent CRM: Privilege escalation through incorrect privilege assignment
Summary
Fluent CRM, a WordPress plugin from WP ManageNinja LLC, contains an incorrect privilege assignment that allows privilege escalation. An attacker with a low-privileged account on the WordPress site, such as a contributor, subscriber or customer account, can gain administrator rights and full control of the site. The CVSS v3.1 base score is 8.8 (HIGH), and the NVD analysis is still pending.
Affected
- Fluent CRM (fluent-crm, WordPress.org) up to and including 3.2.5
Fixed in
- Fluent CRM 3.2.6 (first unaffected version according to the CNA data)
- Install the latest available release, which is at least 3.2.6
Workaround
- Unknown. No vendor-documented workaround was found. Update the plugin as the primary measure.
Exploitation
- No known exploitation in the wild. CISA SSVC lists exploitation as none and automatable as yes.
- Not listed in CISA KEV according to Strix.
- No public proof of concept found; this does not rule one out.
Our recommendation
- Check the installed Fluent CRM version on every WordPress site. Versions up to 3.2.5 are affected.
- Update to the latest available version, at least 3.2.6.
- Review user accounts, remove unused low-privilege accounts and confirm there are no unexpected administrator accounts.
- Restrict or review user registration, especially on sites with many contributor or customer accounts.
- Confirm the fix against the Patchstack page or the WordPress.org changelog before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: Fluent CRM <= 3.2.5 Privilege Escalation patchstack.com
- OpenCVE: CVE-2026-109693 app.opencve.io
- Vulners CVE record: CVE-2026-109693 vulners.com
- Vulners CVEList record: CVE-2026-109693 (CNA JSON) vulners.com
- Strix: CVE-2026-109693 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:33.
Original description (NVD)
Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.