Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-7798: FluentCRM Plugin for WordPress allows attackers to access internal services

CVE-2026-7798 · published 5 months ago

Summary

The FluentCRM plugin for WordPress is vulnerable to a type of attack that allows hackers to access and modify internal services without needing a password. This can happen if the plugin's SES bounce handling key has never been stored. To fix this, make sure to store the SES bounce handling key by visiting the bounce configuration page, and consider updating the plugin to the latest version.

Original advisory text

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published22 May 2026

Updated4 Nov 2026

First seen22 May 2026

Sources

CVE-2026-7798 · NVD

Track software like this

Free during beta