Security Alert Summary
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress has a blind Server-Side Request Forgery (SSRF) vulnerability via the SubscribeURL parameter in affected versions up to and including 2.9.87. Unauthenticated attackers could cause the application to make requests to arbitrary locations originating from the site. Exploitation depends on the site still being in its default SES bounce handling state where the _fc_bounce_key has never been generated and stored.
CVE Details
- CVE ID: CVE-2026-7798
- Affected component: FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress
- Affected versions: All versions up to, and including, 2.9.87
- Published: May 22, 2026 at 9:16:32 AM
- Last modified: May 22, 2026 at 9:16:32 AM
- CVSS v3.1 base score: 5.4
- Severity: MEDIUM
- Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction:
- Authentication required: No (unauthenticated)
- Privileges required: None
- User interaction: None
- Primary impact:
- Confidentiality: Low
- Integrity: Low
- Availability: None
- Weakness / CWE: CWE-918
Technical Details
This vulnerability is a blind Server-Side Request Forgery (SSRF) reachable via the SubscribeURL parameter. When the parameter is processed in affected versions, an attacker can cause the web application to initiate HTTP requests to arbitrary destinations from the server where WordPress and the plugin are running. Because these requests originate from the application, they can reach internal services that are not directly accessible from the internet.
Exploitation is conditional on the site still being in its default SES bounce handling state. The plugin uses an SES bounce handling key stored as _fc_bounce_key; if this key has never been generated and stored (the default/unconfigured state), authentication checks that would otherwise block unauthenticated requests do not evaluate as intended. Visiting the bounce configuration page causes the plugin to auto-generate and store a random key, after which the authentication check will correctly reject unauthenticated requests.
The description identifies the parameter SubscribeURL and the bounce handling key _fc_bounce_key as central to the issue. No other functions, endpoints, or implementation details are named in the provided data.
How This Could Impact Your Website
In a typical small organization, multiple WordPress users may interact with the site: a site owner, internal staff who manage content, and external contractors or contributors. If an attacker can leverage this SSRF, they could probe internal services or endpoints that are normally inaccessible from outside the network. Practical consequences include exposure of internal service endpoints and potentially queryable data from those services.
This exposure can increase the risk of targeted phishing or social engineering because attackers could gather information such as internal API responses or discover email-related infrastructure. For example, an attacker able to reach internal mail or API endpoints might infer user email addresses or other metadata useful for follow-up attacks.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege users that can trigger plugin behavior.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual outbound requests or unexpected access to internal endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L113
- https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L85
- https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L87
- https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L113
- https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L85
- https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L87
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3532271%40fluent-crm&new=3532271%40fluent-crm&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0?source=cve
