EUVD-2026-64784
GHSA-242g-gc8x-5mmf
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Subscriber auth (PR:L), unspecified high-complexity trigger (AC:H), and server-side pivot to internal resources justifies S:C with C:L/I:L; no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
AnalysisAI
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with at minimum WordPress subscriber-level privileges (CVSS PR:L), meaning the attacker must possess or be able to register a valid account on the target site - sites with open registration enabled face a broader attacker pool than invite-only or closed-registration deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 base score of 4.9 (Medium) reflects the constrained attack surface: AC:H signals that exploitation requires conditions beyond simple network reachability, and PR:L requires at minimum subscriber-level authentication, narrowing the attacker population to registered users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a subscriber account on a WordPress site running FluentCRM Pro (or obtains credentials for an existing subscriber), then submits a crafted request to the vulnerable plugin endpoint with a URL pointing to an internal cloud metadata service such as http://169.254.169.254/latest/meta-data/. The WordPress server fetches the resource and returns or processes the response, allowing the attacker to enumerate IAM role credentials or internal service endpoints. … |
| Remediation | The primary remediation is to update FluentCRM Pro beyond version 3.1.12; consult the vendor changelog and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fluentcampaign-pro/vulnerability/wordpress-fluentcrm-pro-plugin-3-1-12-server-side-request-forgery-ssrf-vulnerability for the exact patched release version, as a specific fix version was not independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluentcrm Pro
View allSQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenti
Privilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Edit
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today