FluentCRM EUVD-2026-114278

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against FluentCRM versions up to and including 3.2.6. However, the specific product feature, endpoint, or action protected by the missing authorization check is not described in the available sources, so the exact trigger is not detailed in the evidence. Limiting factors: impact is confined to integrity only (C:N/A:N), meaning the flaw permits unauthorized modification of a limited data set rather than full data disclosure or service disruption; exploitation requires the affected plugin (FluentCRM ≤ 3.2.6) to be installed and active on a reachable WordPress site.

This is a medium-severity issue (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) whose only impact is limited integrity (I:L) with no confidentiality or availability loss. The network vector, low complexity, and no-privilege/no-interaction requirements mean it is remotely reachable without authentication, which raises accessibility, but the capped impact keeps real-world severity moderate rather than critical. Decision signals are mixed-to-moderate: the vuln.today priority label is 'this_month' (not act_now or emergency), there is no CISA KEV listing, no EPSS score was provided in the input, and no SSVC decision tree was supplied. No public exploit was identified at time of analysis - the sole reference is a Patchstack advisory page, not working exploit code. Net assessment: a legitimate but not urgent broken-access-control/missing-authorization flaw; prioritize for routine patching rather than emergency response. Note the gaps: EPSS exploitation probability is missing, and the precise affected endpoint/feature is not described in available sources, so the practical blast radius of the integrity impact cannot be fully characterized.

A remote, unauthenticated attacker sends a crafted HTTP request to a FluentCRM plugin endpoint that fails to enforce an authorization check, allowing an action normally restricted to privileged users. Because CVSS impact is limited to integrity (I:L), the attacker can modify or manipulate a subset of CRM data but cannot read sensitive data or disrupt availability through this flaw alone. No public proof-of-concept or exploit code was identified; only a vendor-style Patchstack advisory reference exists.