CVE-2026-78277: FluentCRM Pro SSRF Vulnerability

CVE-2026-78277 Overview

CVE-2026-78277 is a Server-Side Request Forgery (SSRF) vulnerability affecting FluentCRM Pro versions up to and including 3.1.12. The flaw allows an authenticated user with subscriber-level privileges to coerce the WordPress server into issuing HTTP requests to attacker-controlled or internal destinations. The vulnerability is tracked under CWE-918 and was published to the NVD on 2026-08-24.

Critical Impact
A low-privileged subscriber can abuse the plugin to reach internal network resources, cloud metadata endpoints, and other services otherwise inaccessible from the internet.

Affected Products

FluentCRM Pro (fluentcampaign-pro) plugin for WordPress
All versions up to and including 3.1.12
WordPress deployments using the affected plugin with open subscriber registration

Discovery Timeline

2026-08-24 - CVE-2026-78277 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78277

Vulnerability Analysis

The vulnerability resides in FluentCRM Pro, a WordPress email marketing and customer relationship management plugin. An authenticated attacker holding a subscriber account can invoke a plugin endpoint that fetches a URL supplied in the request without properly validating the destination. The server issues the outbound request on behalf of the attacker, returning or acting upon the response.

Because the request originates from the WordPress host, attackers can reach hosts inside the private network, loopback services, and cloud provider instance metadata services. The confidentiality and integrity impacts are limited in scope, but the scope change indicates that the vulnerable component affects resources beyond its security boundary.

The Exploit Prediction Scoring System (EPSS) probability is 0.148%, indicating a low likelihood of exploitation attempts in the near term. No public proof-of-concept exploit or CISA KEV listing exists at the time of publication.

Root Cause

The root cause is missing or insufficient validation of a user-supplied URL parameter before the plugin performs a server-side HTTP request. The plugin trusts the input and does not enforce an allow-list of destinations, block private IP ranges, or reject requests to loopback and link-local addresses. This aligns with CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires network access and a valid subscriber account, which is trivial to obtain on WordPress sites with open user registration. The attacker submits a crafted request containing a URL pointing at an internal service such as http://127.0.0.1, http://169.254.169.254/latest/meta-data/ on AWS, or an internal management interface. The plugin then performs the request, potentially exposing metadata, tokens, or reachable internal services to the attacker. Attack complexity is rated High, reflecting conditional requirements such as authenticated subscriber access and knowledge of reachable internal endpoints. For full technical context, see the Patchstack SSRF Vulnerability Report.

Detection Methods for CVE-2026-78277

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 127.0.0.0/8.
Requests to cloud metadata endpoints such as 169.254.169.254 originating from the PHP process.
Unexpected authenticated subscriber activity targeting FluentCRM Pro AJAX or REST endpoints.

Detection Strategies

Inspect web server access logs for POST or GET requests to FluentCRM Pro endpoints containing URL parameters referencing IP literals or hostnames.
Correlate authenticated subscriber sessions with subsequent outbound connections from the PHP-FPM or Apache worker processes.
Alert on any egress from web servers to link-local or RFC1918 addresses that is not on an approved allow-list.

Monitoring Recommendations

Enable verbose logging on the WordPress host and forward logs to a centralized analytics platform for correlation.
Monitor for spikes in subscriber account creation followed by API interactions with the FluentCRM Pro plugin.
Deploy egress filtering and log denied outbound connections for retrospective analysis.

How to Mitigate CVE-2026-78277

Immediate Actions Required

Upgrade FluentCRM Pro to a version later than 3.1.12 as soon as the vendor publishes a fixed release.
Audit WordPress user accounts and remove unused or suspicious subscriber accounts.
Restrict WordPress user registration if it is not required for business operations.

Patch Information

Refer to the Patchstack SSRF Vulnerability Report for the authoritative advisory and the fixed version once released by the vendor. Apply the patch through the WordPress plugin update mechanism and validate the plugin version after installation.

Workarounds

Block the vulnerable plugin endpoints at the web application firewall until a patch is applied.
Enforce strict egress filtering on the WordPress host to deny outbound requests to RFC1918, loopback, and link-local ranges including 169.254.169.254.
On AWS, migrate to Instance Metadata Service Version 2 (IMDSv2) to require session tokens for metadata access.
Temporarily disable FluentCRM Pro if the plugin is not business-critical.

bash

# Configuration example: block egress to metadata and private ranges from the web tier
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT