CVE-2026-7798: FluentCRM WordPress Plugin SSRF Vulnerability

CVE-2026-7798 Overview

CVE-2026-7798 is a Blind Server-Side Request Forgery (SSRF) vulnerability in the FluentCRM plugin for WordPress, affecting all versions up to and including 2.9.87. The flaw resides in the handling of the SubscribeURL parameter within the Amazon SES bounce handling logic in app/Hooks/Handlers/ExternalPages.php. Unauthenticated attackers can coerce the WordPress application into issuing arbitrary outbound HTTP requests, enabling reconnaissance and interaction with internal services that are otherwise unreachable from the public internet. Exploitation is conditional on the SES bounce handling key (_fc_bounce_key) never having been initialized, which is the default state on sites that have not opened the SES bounce configuration page.

Critical Impact

Unauthenticated attackers can pivot from a vulnerable WordPress site to internal network services, cloud metadata endpoints, or other restricted resources by abusing the plugin's webhook subscription handler.

Affected Products

• FluentCRM plugin for WordPress, all versions up to and including 2.9.87
• WordPress sites where the SES bounce handling key _fc_bounce_key has never been generated
• Default/unconfigured FluentCRM installations with respect to Amazon SES bounce handling

Discovery Timeline

• 2026-05-22 - CVE-2026-7798 published to the National Vulnerability Database
• 2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-7798

Vulnerability Analysis

The vulnerability is classified under [CWE-918] Server-Side Request Forgery. FluentCRM exposes an externally reachable endpoint that processes Amazon Simple Email Service (SES) bounce notifications. When SES delivers a subscription confirmation, it includes a SubscribeURL parameter that the receiver is expected to fetch to confirm the subscription. The plugin honors this SubscribeURL and issues a server-side HTTP request to the supplied location.

Because the request originates from the WordPress host, an attacker controlling the SubscribeURL value can target hosts and ports inside the perimeter, including loopback services, cloud instance metadata endpoints, and internal APIs. The SSRF is blind in that the HTTP response body is not reflected to the attacker, but request side effects and timing can still be used to query and modify internal state.

Root Cause

The root cause is an authentication check that fails open when the _fc_bounce_key option has never been stored in the WordPress options table. Visiting the bounce configuration page auto-generates and persists a random key, after which the comparison rejects unauthenticated requests. On sites where an administrator has not opened that page, the stored key is empty, and the comparison evaluates in a way that admits arbitrary callers. The handler then trusts the attacker-supplied SubscribeURL without enforcing an allowlist of permitted destinations or restricting requests to public, non-internal addresses.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, although successful exploitation depends on the target site being in the default unconfigured SES bounce state. An attacker sends a crafted HTTP request to the FluentCRM external pages endpoint with a SubscribeURL parameter pointing to an internal resource such as http://127.0.0.1:8080/admin, http://169.254.169.254/latest/meta-data/ on cloud instances, or an internal management API. The plugin then issues the outbound request from the WordPress server, allowing the attacker to reach services that are firewalled from the public internet.

No verified proof-of-concept code is published. Relevant source locations are documented in the WordPress plugin repository at ExternalPages.php line 85, line 87, and line 113.

Detection Methods for CVE-2026-7798

Indicators of Compromise

• Inbound HTTP requests to FluentCRM external page handlers containing a SubscribeURL parameter whose host resolves to private (RFC1918), loopback, or link-local addresses.
• Outbound HTTP requests originating from the WordPress PHP worker to 169.254.169.254, 127.0.0.1, or internal hostnames shortly after inbound traffic to the FluentCRM endpoint.
• WordPress option table missing the _fc_bounce_key entry on sites with FluentCRM installed and active.
• Unusual patterns of SubscribeURL values in web server access logs targeting non-AWS SNS domains.

Detection Strategies

• Inspect web access logs for requests to FluentCRM endpoints with SubscribeURL parameters and validate that the destination host belongs to expected AWS SNS infrastructure.
• Correlate inbound requests to the plugin with subsequent outbound DNS or HTTP egress from the same PHP process to detect SSRF chains.
• Audit installed FluentCRM versions across the WordPress estate and flag any instance running 2.9.87 or earlier.

Monitoring Recommendations

• Enable egress filtering on WordPress hosts and alert on connections from PHP workers to RFC1918, loopback, or cloud metadata addresses.
• Monitor outbound traffic to 169.254.169.254 from any web-tier server and treat it as high-priority unless explicitly expected.
• Track changes to the wp_options table for additions or modifications of the _fc_bounce_key row to confirm the site has moved out of the vulnerable default state.

How to Mitigate CVE-2026-7798

Immediate Actions Required

• Update the FluentCRM plugin to the version that supersedes 2.9.87 as published in the WordPress plugin repository changeset.
• For sites that cannot patch immediately, navigate to the FluentCRM SES bounce configuration page once to force generation and storage of the _fc_bounce_key value, which restores the authentication check.
• Restrict outbound network access from the WordPress host to deny connections to internal IP ranges and cloud metadata endpoints.
• Require IMDSv2 on AWS EC2 instances to reduce the impact of SSRF against the instance metadata service.

Patch Information

The maintainers published a fix in the FluentCRM plugin trunk. Review the upstream commit details in the WordPress Plugin Changeset and the Wordfence Vulnerability Analysis for remediation guidance and affected file paths.

Workarounds

• Visit the FluentCRM SES bounce configuration page on each WordPress site to seed the _fc_bounce_key option, which closes the unauthenticated path.
• Place a web application firewall rule in front of the FluentCRM external pages endpoint that rejects requests where SubscribeURL does not resolve to a recognized AWS SNS domain.
• Configure the WordPress host firewall to block PHP-initiated egress to private network ranges and cloud metadata services.

# Example egress restriction using iptables on a Linux WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT