EUVD-2026-66935
GHSA-mxvf-mh6j-w652
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Editor is a non-administrative WordPress role, making PR:L more accurate than PR:H; all other metrics align with the provided vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
AnalysisAI
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Editor role to elevate their access level, yielding full confidentiality, integrity, and availability impact against the WordPress installation. Reported by Patchstack and scored CVSS 7.2 with PR:H, the flaw is rooted in CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to correctly enforce role boundaries for Editors interacting with CRM functionality. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with the Editor role (or a role of equivalent or higher standing granted by the plugin's incorrect assignment logic). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 score with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H signals that while the attack is network-accessible and requires no user interaction, exploitation is gated behind a high-privilege account (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a WordPress Editor account - obtained via credential theft, account compromise, or legitimate provisioning on a multi-author site - sends a crafted request to a FluentCRM Pro endpoint that fails to enforce role boundaries. The plugin incorrectly grants the Editor elevated privileges, such as Administrator, enabling the attacker to install malicious plugins, create new admin accounts, exfiltrate the site database, or fully deface or take over the WordPress installation. … |
| Remediation | Update FluentCRM Pro to a version beyond 3.1.12 as soon as one is confirmed available from WP Manage Ninja. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit WordPress instances for FluentCRM Pro versions ≤3.1.12 and immediately restrict Editor role to trusted administrators only; review access logs for unauthorized CRM activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluentcrm Pro
View allSQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenti
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today