Fluent CRM: Privilege escalation via incorrect privilege assignment

Summary

Fluent CRM, a WordPress plugin for email marketing and customer relationship management, contains an incorrect privilege assignment that allows privilege escalation. According to the Patchstack advisory, an unauthenticated attacker can gain administrator rights and full control of the affected WordPress site. Versions up to and including 3.2.5 are affected; the CVSS score is 9.8 (critical).

Affected

• Fluent CRM WordPress plugin, versions up to and including 3.2.5

Fixed in

• Fluent CRM 3.2.6 (per Patchstack and the CNA record, which advises at least 3.2.6)

Workaround

• Unknown from the vendor.
• Patchstack has published a virtual mitigation rule that blocks attacks until the plugin is updated; this requires a Patchstack subscription.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Patchstack rates the flaw as high priority and expects exploitation; this is its assessment, not a confirmed exploitation.
• No public proof of concept was found in the research.

Our recommendation

• Check whether Fluent CRM is installed on any WordPress site and identify its version.
• Update Fluent CRM to version 3.2.6 or later immediately.
• If an update is not possible at once, ask the hosting provider or web developer for a mitigation.
• Review administrator and user accounts for unexpected new or elevated accounts, and check for public registration.
• Monitor the site for signs of compromise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: Fluent CRM <= 3.2.5 Privilege Escalation patchstack.com
• OpenCVE: CVE-2026-109694 app.opencve.io
• Vulners: CVE-2026-109694 vulners.com
• ThreatInt: CVE-2026-109694 cve.threatint.com
• WPScan: Fluent CRM plugin wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:51.