Description

Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-27T10:16:37.133Z",
  "pubdate": "2026-08-27T10:16:37.133Z",
  "executiveSummary": "A privilege escalation vulnerability exists in FluentCRM Pro versions up to and including 3.1.12. This security flaw allows an authenticated user with Editor-level privileges to perform unauthorized administrative actions.\nThe vulnerability is rooted in insufficient access control mechanisms within the plugin's internal request handling, enabling an attacker to bypass intended role-based restrictions.\nBy manipulating specific API requests or function calls, an Editor can escalate their functional capabilities to those of an Administrator, potentially leading to a complete site compromise.\nThe impact is significant, as it grants unauthorized access to sensitive configuration data, user management, and plugin settings. Exploitation does not require external network access beyond what is already available to an authenticated Editor. Organizations running affected versions are at high risk if they allow untrusted users to maintain Editor accounts, as the attacker possesses the necessary initial authentication to execute the exploit payload.",
  "technicalDetails": "The vulnerability in FluentCRM Pro <= 3.1.12 stems from improper authorization checks when processing requests directed at sensitive administrative endpoints or functions. In WordPress plugin development, security relies on enforcing strict checks using capabilities (e.g., current_user_can()) before executing sensitive code paths. In this instance, the plugin fails to properly validate the user's role against the required administrative privilege level when invoking specific backend operations.\nThe attack flow begins with an authenticated user holding the 'Editor' role. The attacker identifies internal API endpoints or administrative action handlers that are intended to be restricted to 'Administrator' users only. Because the plugin performs incomplete or missing capability checks, these handlers process the request without verifying the user's authority to modify global settings or perform privileged system operations.\nAn attacker can craft a malicious HTTP request targeting these vulnerable endpoints. By manipulating the request parameters, the attacker can successfully execute administrative functions that were designed to be isolated from low-privileged accounts. The failure occurs in the function or controller responsible for mediating access to the plugin's core configuration and management interfaces.\nPost-exploitation, the attacker can gain full control over the FluentCRM Pro plugin configuration. This includes the ability to modify automation workflows, access customer databases, change SMTP/email settings for phishing or data exfiltration, and potentially pivot to wider WordPress administrative access if the plugin's scope allows for such interaction. The absence of a robust authorization gate ensures that the request is treated as a legitimate administrative command.\nThe root cause is a failure in the plugin’s access control layer, where administrative interfaces are insufficiently protected against authenticated users who possess non-administrative capabilities. Given the interconnected nature of the WordPress admin backend, the ability for an Editor to interact with these privileged code paths essentially breaks the plugin's security model, allowing for horizontal and vertical privilege escalation."
}