Description

Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-24T12:16:55.043Z",
  "pubdate": "2026-08-24T12:16:55.043Z",
  "executiveSummary": "An Author SQL Injection vulnerability has been identified in FluentCRM Pro versions <= 3.1.12. This security flaw involves improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. The vulnerability allows authenticated attackers with Author-level privileges or higher to execute arbitrary SQL queries against the underlying database. Successful exploitation of this vulnerability can lead to unauthorized data retrieval, sensitive information disclosure, data manipulation, and potential compromise of the WordPress database. The risk implication is severe, as it grants authenticated malicious actors direct interaction with the database management system, bypassing application-layer logic. Exploitation requires specific authentication privileges, limiting the threat vector to accounts with at least Author-level access within the affected WordPress environment. Remediation involves restricting user privileges and applying the vendor's official security updates once available.",
  "technicalDetails": "The vulnerability exists within the database query construction mechanisms of the FluentCRM Pro plugin for versions <= 3.1.12. The root cause stems from the failure to properly sanitize and parameterize user-supplied input before incorporating it into database queries executed by the application. Specifically, functions handling data input fail to employ prepared statements or adequate type casting, allowing input controlled by users with Author privileges to alter the Abstract Syntax Tree (AST) of the executing SQL queries.\nThe attack flow begins with an authenticated attacker possessing Author-level privileges. The attacker crafts a malicious HTTP request containing a specially engineered payload designed to manipulate SQL logic. This payload is submitted to a vulnerable endpoint within the FluentCRM Pro plugin. Because the application improperly validates or escapes the input parameters, the injected SQL commands are concatenated directly into the database query string.\nUpon receipt, the database execution engine interprets the injected strings as legitimate SQL syntax, altering the intended query logic. Depending on the construction of the injection, the payload behavior may include boolean-based blind inferences, time-based delays, or stacked queries, facilitating the extraction of sensitive database contents such as user credentials, customer data, and internal application settings.\nThe affected component involves the backend processing logic of FluentCRM Pro handling database interactions for user-controlled parameters. The vulnerability requires network exposure via the standard WordPress HTTP interface and mandates active session authentication with at least Author privileges. Post-exploitation impact includes unauthorized data exfiltration, database modification, and potential escalation of privileges within the broader WordPress ecosystem depending on database user permissions and configurations."
}