CVE-2026-78277
Received Received - Intake

Subscriber Server Side Request Forgery in FluentCRM Pro

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Patchstack

Description
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78277
EUVD
EUVD-2026-64784

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fluentcrm fluentcrm_pro to 3.1.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78277 is a Server Side Request Forgery (SSRF) vulnerability in the WordPress FluentCRM Pro Plugin versions 3.1.12 and below. It allows attackers with subscriber-level access to make unauthorized requests to internal or external domains, potentially exposing sensitive information from other services on the same system.

Detection Guidance

Check if your FluentCRM Pro plugin version is 3.1.12 or below. Logs may show unusual requests from subscriber accounts. Monitor network traffic for unexpected outbound connections from the WordPress server.

Impact Analysis

An attacker could exploit this to access internal systems or sensitive data, leading to data breaches or unauthorized information disclosure. The impact depends on the services running on the affected server.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face compliance penalties if sensitive data is exposed due to this flaw.

Mitigation Strategies

Update FluentCRM Pro to version 3.1.13 or later immediately. If updating is not possible, disable the plugin temporarily or restrict subscriber access to sensitive functions. Enable auto-updates for plugins if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78277. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart