FluentCRM Pro EUVD-2026-66935

Exploitation requires an authenticated WordPress session with the Editor role (or a role of equivalent or higher standing granted by the plugin's incorrect assignment logic). CVSS PR:H confirms that unauthenticated access is not sufficient - a valid account with elevated-but-sub-administrator WordPress credentials is the minimum prerequisite. The plugin must be installed and active on the target WordPress site. What limits exploitation: the attacker must already possess a WordPress Editor-level account on the target site, which is not obtainable without prior credential compromise or deliberate provisioning. Sites that do not grant Editor-level access to untrusted users, or that have no FluentCRM Pro installation, are not affected.

The CVSS 7.2 score with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H signals that while the attack is network-accessible and requires no user interaction, exploitation is gated behind a high-privilege account (PR:H). The C:H/I:H/A:H triad indicates that a successful escalation results in full compromise of the WordPress instance. No EPSS data was provided, and neither a CISA KEV listing nor public proof-of-concept code has been identified, moderating real-world urgency. The practical risk surface is limited to WordPress sites where untrusted or semi-trusted users have been granted the Editor role - a meaningful concern in multi-author sites, editorial teams, or agencies that provision Editor accounts to clients. The PR:H designation in the provided vector is worth scrutiny: the WordPress Editor role is not an administrative role, so some analysts may reasonably classify it as PR:L, which would raise the calculated score to approximately 8.8. This ambiguity should be confirmed against the vendor advisory.

An attacker who holds a WordPress Editor account - obtained via credential theft, account compromise, or legitimate provisioning on a multi-author site - sends a crafted request to a FluentCRM Pro endpoint that fails to enforce role boundaries. The plugin incorrectly grants the Editor elevated privileges, such as Administrator, enabling the attacker to install malicious plugins, create new admin accounts, exfiltrate the site database, or fully deface or take over the WordPress installation. No public exploit code has been identified at time of analysis.