CVE-2026-78468: FluentCRM Pro <= 3.1.12 - Authenticated (Author+) SQL Injection
The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Which WordPress users could exploit this issue?
An attacker needs an authenticated WordPress account with the Author role or a higher privilege level. Unauthenticated visitors cannot exploit it based on the available information.
What could an attacker gain through successful exploitation?
The SQL injection can be used to append queries to existing database queries and extract sensitive information from the WordPress database. The provided data does not indicate integrity or availability impact.
Which installations should be considered affected?
FluentCRM Pro versions up to and including 3.1.12 are affected. The issue is not described as requiring a non-default configuration, so deployments running an affected version should assess exposure wherever Author-or-higher accounts exist.