What the vulnerability does
01Description
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
Explanation of Vulnerability in Simple Terms
02Summary
FluentCRM versions up to 2.9.87 contain a server-side request forgery vulnerability that allows an attacker to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires specific network conditions to exploit but can leak sensitive information or modify data on connected services. No user interaction is required.
What an attacker can do
03Attacker Capabilities
Make the site send HTTP requests to internal systems or external servers to read or modify data.
Potential impact on your site
04Site Impact
Attackers could access internal services, leak credentials, or modify data on systems the site can reach.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required, but exploitation requires specific network conditions.
Key dates
06Disclosure timeline
May 22, 2026
CVE published
May 22, 2026
Record updated
