PatchSiren cyber security CVE debrief
CVE-2026-7798 techjewel CVE debrief
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
- Vendor
- techjewel
- Product
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-22
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-05-22
- Advisory updated
- 2026-07-23
Who should care
Administrators of WordPress installations using the FluentCRM plugin, especially those with unconfigured SES bounce handling, should be aware of this vulnerability and take immediate action to protect their sites.
Technical summary
The FluentCRM plugin for WordPress is vulnerable to Blind Server-Side Request Forgery (SSRF) due to inadequate handling of the 'SubscribeURL' parameter. This vulnerability allows unauthenticated attackers to make arbitrary web requests on behalf of the web application, potentially leading to unauthorized access or modification of internal services. The exploitation of this vulnerability is contingent upon the site being in its default state regarding SES bounce handling, where the '_fc_bounce_key' has not been generated or stored. Once the bounce configuration page is visited, a random key is auto-generated, and the authentication check correctly rejects unauthenticated requests.
Defensive priority
High
Recommended defensive actions
- Immediately update the FluentCRM plugin to the latest version if available.
- If an update is not available, consider disabling the plugin until a patch is released.
- Configure SES bounce handling to generate and store the '_fc_bounce_key'.
- Monitor your WordPress site for unusual traffic patterns or requests.
- Implement additional security measures such as web application firewalls (WAFs) to detect and prevent SSRF attacks.
Evidence notes
The CVE record was published on 2026-05-22T09:16:32.587Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. The vulnerability was reported by [email protected].
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T09:16:32.587Z and has not been modified since then. The NVD entry is currently Deferred.