FluentCRM CVE-2026-7798

Exploitation requires that the FluentCRM SES bounce handling configuration key ('_fc_bounce_key') has NEVER been stored in the WordPress options table - specifically, this key must not exist in the database. This is the default state on any installation where no administrator has ever visited the FluentCRM SES bounce configuration page. Visiting that page auto-generates and persists a random key, after which the authentication check in ExternalPages.php evaluates correctly and rejects unauthenticated requests, fully closing the attack window. The exploitable surface is therefore limited to: newly installed FluentCRM deployments before any admin interaction with SES bounce settings, and sites that have explicitly cleared this configuration value. Attack complexity is rated High (AC:H) precisely because of this precondition. Exploitation is further limited in impact on sites not hosted in environments with accessible internal services or cloud metadata endpoints, since the SSRF yields only C:L/I:L with no availability impact.

The CVSS 5.4 (Medium) score with AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N captures the tension in this vulnerability well. The network vector and no-privileges requirement are alarming on the surface, but High Attack Complexity correctly reflects the narrow precondition: the site must never have had its SES bounce key initialized, which is automatically remedied the moment any admin visits the bounce configuration page. This significantly reduces the realistic attack surface to newly installed or persistently misconfigured deployments. The Changed Scope with C:L/I:L is meaningful in cloud-hosted WordPress environments where metadata service access (e.g., AWS IMDS) could yield IAM credentials, escalating impact well beyond the raw CVSS score implies. No EPSS data was provided; KEV status is not listed, and no POC exploit code has been identified - though the WordPress plugin repository changeset is publicly visible and exposes the vulnerable logic, lowering the barrier for independent reproduction. SSVC signals: exploitation status is 'none' per available data; automation potential is moderate given HTTP-accessible trigger; technical impact is partial. Real-world priority is moderate for cloud-hosted WordPress sites; low for on-premises deployments without internal network resources of value.

An attacker scanning for WordPress sites with FluentCRM installed identifies a target where the SES bounce handling key has never been configured - common on freshly installed or lightly administered sites. The attacker sends an unauthenticated POST request to the SES bounce webhook endpoint with a crafted 'SubscribeURL' value pointing to the AWS EC2 instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The WordPress server fetches that URL and may return IAM role credentials back through the response, granting the attacker cloud-level access. No public exploit code has been identified, but the vulnerable code path is publicly visible in the plugin repository.