FluentCRM Pro CVE-2026-78468

Exploitation requires an active, authenticated WordPress session with Author-level role or higher on the target site - unauthenticated exploitation is not possible per the CVSS PR:L metric. The vulnerability exists in all FluentCRM Pro installations up to and including version 3.1.12 with no indication of a non-default configuration requirement; any site running the plugin within the affected version range is potentially vulnerable once the attacker satisfies the authentication prerequisite. Limiting factors: the attacker must possess or acquire a valid WordPress account with at minimum the Author role, which constrains opportunistic mass exploitation but is realistic in multi-author publishing environments or where account registration is open. The scope is unchanged (S:U), so impact is limited to the WordPress database accessible to the site's DB user and does not inherently pivot to the underlying OS.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), accurately reflecting a network-reachable, low-complexity attack constrained by the requirement for Author-level WordPress credentials. The high confidentiality impact is the primary driver: a successful extraction can yield subscriber PII, email content, lead records, API keys stored in plugin settings, and potentially hashed WordPress credentials from the wp_users table. No EPSS score was provided in the input data, and the absence of a CISA KEV listing suggests exploitation has not been confirmed as widespread. No public proof-of-concept code was referenced. Despite the Medium CVSS rating, the practical risk is elevated in multi-author WordPress environments - a site with contributor or author accounts accessible to external parties (such as a guest-posting workflow) provides the necessary foothold - meaning even a mid-sized operator such as a municipal services portal in a city like swidnica running a FluentCRM-backed subscriber list should treat this as an urgent patching priority. Integrity and availability are not impacted per the CVSS vector, which is consistent with a read-only SQL injection pattern.

An attacker who has obtained or registered a WordPress Author account - for example through a guest-post program or a compromised contributor credential - crafts a malicious value in a FluentCRM Pro plugin parameter that appends a UNION-based or time-based SQL subquery. The injected query runs in the context of the WordPress database user, allowing the attacker to enumerate tables and dump sensitive records such as subscriber email addresses, CRM contact data, or hashed user passwords from wp_users. No public proof-of-concept has been identified at time of analysis, but CWE-89 injection patterns against WordPress plugins are well-documented and the technique is straightforward for any intermediate attacker.