FluentCRM Pro CVE-2026-78270

Exploitation requires an authenticated WordPress session with high-privilege (administrator-level) access to the FluentCRM Pro plugin, as confirmed by the PR:H metric in the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L vector. The specific vulnerable surface is the Author filtering or query parameter within the FluentCRM Pro administrative interface, so the attacker must have access to that specific feature. FluentCRM Pro must be installed and active on the target WordPress site. Factors that limit exploitation: (1) Only WordPress accounts with high-privilege roles (administrators or users explicitly granted FluentCRM admin capabilities) can reach the vulnerable parameter - lower roles such as Author, Editor, Subscriber, or Contributor are not in scope; (2) The I:N CVSS metric indicates the injection appears read-only, precluding direct database writes or schema modification via this vector alone; (3) Installations that have removed or restricted access to FluentCRM Pro's author filter functionality through role management plugins would reduce exposure.

The CVSS 7.6 High score is anchored by the scope change (S:C) and full confidentiality impact (C:H), but the PR:H requirement is the critical real-world mitigating factor - exploitation requires an already-authenticated, high-privileged user (WordPress administrator or equivalent), substantially shrinking the viable attack population compared to unauthenticated vulnerabilities. No EPSS score was included in the provided intelligence, leaving probabilistic exploitation frequency unquantifiable from base rates alone. The absence of a CISA KEV listing and lack of any reported public POC further suggest this is not under active or widespread exploitation. The primary realistic threat model is a compromised administrator account or malicious insider leveraging this injection to escalate data exfiltration scope beyond what FluentCRM Pro's own UI exposes. The I:N metric (no integrity impact) indicates a read-only injection pattern, limiting direct data manipulation. Overall assessment: treat as a routine patch-cycle priority; the PR:H gating means this does not warrant emergency out-of-band response for most organizations, but administrator credential hygiene is a co-critical control.

An attacker with WordPress administrator credentials - obtained via phishing, credential stuffing against a reused password, or a prior site compromise - authenticates to the WordPress admin panel and navigates to the FluentCRM Pro campaign or contact interface. The attacker crafts a malicious Author parameter value containing SQL injection syntax (e.g., a UNION SELECT or time-based blind payload), which the plugin passes unsanitized to the database engine. The resulting query returns data from arbitrary tables across the WordPress database, allowing full extraction of CRM contact records, email campaign metadata, and wp_users password hashes. No public exploit code has been identified at time of analysis, but the AC:L rating indicates exploitation is technically straightforward for any attacker with administrative access.