EUVD-2026-64835
GHSA-gv84-hx59-95x6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Network-accessible WordPress plugin requiring administrator-level authentication (PR:H); scope change reflects cross-table database reads beyond plugin boundary; no integrity impact consistent with read-only SQL injection pattern.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
AnalysisAI
SQL injection in FluentCRM Pro (WordPress plugin, versions ≤ 3.1.12) allows network-accessible, high-privileged authenticated users to inject arbitrary SQL via the Author parameter, compromising full database confidentiality. The CVSS scope change (S:C) with C:H indicates successful exploitation extends read access well beyond the plugin's own tables - potentially exposing CRM contact records, campaign data, and WordPress user credential hashes stored in the underlying MySQL/MariaDB database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with high-privilege (administrator-level) access to the FluentCRM Pro plugin, as confirmed by the PR:H metric in the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 High score is anchored by the scope change (S:C) and full confidentiality impact (C:H), but the PR:H requirement is the critical real-world mitigating factor - exploitation requires an already-authenticated, high-privileged user (WordPress administrator or equivalent), substantially shrinking the viable attack population compared to unauthenticated vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with WordPress administrator credentials - obtained via phishing, credential stuffing against a reused password, or a prior site compromise - authenticates to the WordPress admin panel and navigates to the FluentCRM Pro campaign or contact interface. The attacker crafts a malicious Author parameter value containing SQL injection syntax (e.g., a UNION SELECT or time-based blind payload), which the plugin passes unsanitized to the database engine. … |
| Remediation | The primary fix is to upgrade FluentCRM Pro to a version above 3.1.12 immediately, as all versions at or below this release are confirmed vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations running FluentCRM Pro versions ≤3.1.12 and audit admin-level user accounts for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fluentcrm Pro
View allPrivilege escalation in FluentCRM Pro (WordPress plugin, versions <= 3.1.12) allows authenticated users holding the Edit
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today