FluentCRM Pro CVE-2026-78277

Exploitation requires an authenticated session with at minimum WordPress subscriber-level privileges (CVSS PR:L), meaning the attacker must possess or be able to register a valid account on the target site - sites with open registration enabled face a broader attacker pool than invite-only or closed-registration deployments. The AC:H rating indicates an additional constraint beyond mere authentication, though the specific triggering condition (e.g., a particular plugin feature being active, a specific request structure) is not enumerated in the available description and should be confirmed via the Patchstack disclosure. Exploitation is limited to network-reachable WordPress installations; the server's outbound network egress determines the blast radius, with cloud-hosted instances on AWS/GCP/Azure facing the highest internal-resource exposure. Subscriber registration must be enabled on the WordPress site, or the attacker must already possess a low-privilege account obtained through other means.

The NVD-assigned CVSS 3.1 base score of 4.9 (Medium) reflects the constrained attack surface: AC:H signals that exploitation requires conditions beyond simple network reachability, and PR:L requires at minimum subscriber-level authentication, narrowing the attacker population to registered users. The scope change (S:C) with C:L and I:L indicates that while individual impact per request is bounded, the vulnerability can be used to probe or interact with internal infrastructure - cloud metadata endpoints (e.g., 169.254.169.254), internal APIs, or intranet services - representing a meaningful lateral-movement primitive in cloud-hosted WordPress environments. No EPSS score was provided, and the vulnerability has neither a KEV listing nor known public POC, suggesting exploitation is not currently widespread. Real-world risk is elevated for WordPress installations on cloud infrastructure where metadata services or internal APIs are reachable from the web server, and reduced for on-premises deployments with tight network egress controls. The AC:H rating should be independently verified with Patchstack's disclosure for the exact triggering condition.

An attacker registers a subscriber account on a WordPress site running FluentCRM Pro (or obtains credentials for an existing subscriber), then submits a crafted request to the vulnerable plugin endpoint with a URL pointing to an internal cloud metadata service such as http://169.254.169.254/latest/meta-data/. The WordPress server fetches the resource and returns or processes the response, allowing the attacker to enumerate IAM role credentials or internal service endpoints. No public POC exists at time of analysis, but the attack pattern is well-understood for WordPress SSRF classes.