CVE-2026-7798: FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('fcbouncekey') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FluentCRM (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.9.87 - Configuration
Ensure the SES bounce handling key ('_fc_bounce_key') has never been stored; if it was auto-generated by visiting the bounce configuration page, revert to the default/unconfigured state so authentication checks cannot evaluate correctly for unauthenticated requests.
SES bounce handling _fc_bounce_key = Never store (keep site in default/unconfigured state with respect to SES bounce handling)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7798?
CVE-2026-7798 has a medium severity rating of 5.4.
What type of vulnerability is CVE-2026-7798?
CVE-2026-7798 is classified as an Unauthenticated Blind Server-Side Request Forgery (SSRF) vulnerability.
How do I fix CVE-2026-7798?
To fix CVE-2026-7798, update FluentCRM to the latest version beyond 2.9.87.
What versions are affected by CVE-2026-7798?
CVE-2026-7798 affects all versions of FluentCRM up to and including version 2.9.87.
What is the potential impact of CVE-2026-7798?
The potential impact of CVE-2026-7798 is that it allows unauthenticated users to exploit the 'SubscribeURL' parameter for server-side requests.