EUVD-2026-31418
GHSA-pq4x-338r-cq3h
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
1DescriptionCVE.org
The FluentCRM - Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
AnalysisAI
Blind Server-Side Request Forgery in FluentCRM (WordPress plugin, all versions ≤2.9.87) allows unauthenticated remote attackers to coerce the web server into issuing arbitrary HTTP requests via the 'SubscribeURL' parameter in SES bounce handling. Exploitation is constrained to sites where the SES bounce handling key has never been initialized - a default state that persists until an administrator visits the bounce configuration page. Successfully exploited, this flaw can be used to probe and interact with internal services (cloud metadata endpoints, intranet APIs, adjacent containers), achieving limited but meaningful confidentiality and integrity impact across a changed scope. No public exploit or CISA KEV listing exists at time of analysis, though source code references expose the vulnerable code path directly.
Technical ContextAI
FluentCRM is a self-hosted CRM and email automation plugin for WordPress (CPE: cpe:2.3:a:techjewel:fluentcrm_-_email_newsletter,_automation,_email_marketing,_email_campaigns,_optins,_leads,_and_crm_solution:*:*:*:*:*:*:*:*). The vulnerability resides in ExternalPages.php (lines 85, 87, 113), which handles inbound AWS SES bounce/subscription notification webhooks. The handler accepts a user-supplied 'SubscribeURL' parameter and issues a server-side HTTP request to that URL without sufficient authentication enforcement when the '_fc_bounce_key' configuration key has not yet been initialized. CWE-918 (Server-Side Request Forgery) describes the root cause: user-controlled input is used as a URL target for a server-initiated request without allowlisting or origin validation. The changed scope (S:C in CVSS) reflects that the forged request can reach systems beyond the WordPress application boundary - internal network hosts, cloud provider metadata services (e.g., 169.254.169.254), or other containerized services - that the attacker could not reach directly.
RemediationAI
A fix has been committed to the FluentCRM plugin repository (WordPress.org changeset 3532271: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3532271%40fluent-crm&new=3532271%40fluent-crm), but the exact patched release version is not independently confirmed from available data - update to the latest version available in the WordPress plugin repository and verify via the changelog that changeset 3532271 is included. As an immediate compensating control, any administrator can neutralize the vulnerability by visiting the FluentCRM SES bounce configuration page, which auto-generates and stores the '_fc_bounce_key'; once stored, the authentication check correctly rejects unauthenticated requests to the bounce handler. Trade-off: this workaround is configuration-dependent and could be reversed if the key is manually cleared. Additionally, network-level egress filtering on the WordPress server to block requests to RFC-1918 addresses and cloud metadata endpoints (e.g., 169.254.169.254) will limit SSRF impact even if the handler remains reachable. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0 should be monitored for patched version confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today