CVE-2026-7798
MediumFluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
Published May 22, 2026 · Updated Jul 23, 2026 · Also known as 5c3ca2d7-7af9-401f-bc5a-1796c6253cb0
Key Facts
Routine patching- CVE-2026-7798 is a medium-severity vulnerability (CVSS 5.4 v3.1) affecting fluent-crm (wordpress-plugin), FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.8% probability of exploitation in the next 30 days.
- Fixed versions are available, including fluent-crm 3.0.0.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
5.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
0.8%
Higher than 56.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-7798 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| fluent-crmwordpress-plugin | See advisory | 3.0.0 |
| FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | See advisory | n/a |
Patched Releases
fluent-crm
3.0.0
Timeline
Publicly disclosed
May 22, 2026
Last updated
Jul 23, 2026
Weakness Type
- CWE-918 Server-Side Request Forgery (SSRF)
References
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0?source=api-prod
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0?source=api-scan
- otherhttps://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L113
- otherhttps://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L85
- otherhttps://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L87
FAQ
Common Questions.
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter.
Affected: fluent-crm (wordpress-plugin); FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including fluent-crm 3.0.0.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-7798 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo