CVE-2026-78277: WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress FluentCRM Pro pluginto a version that resolves this vulnerability.Fixed in 3.1.13
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is described as subscriber-accessible and requires low privileges. An attacker would need an account or access level that qualifies as a subscriber.
Is exploitation straightforward over the network?
The CVSS vector indicates network access is possible and no user interaction is required, but exploitation has high attack complexity. The available data does not identify the specific conditions that make exploitation complex.
What security impact can successful exploitation have?
Successful exploitation may affect confidentiality and integrity at a low level, while no availability impact is indicated. The scope is marked changed, meaning the impact can extend beyond the vulnerable component's security authority.