Description

Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-24T12:16:55.347Z",
  "pubdate": "2026-08-24T12:16:55.347Z",
  "executiveSummary": "A Server Side Request Forgery (SSRF) vulnerability has been identified in FluentCRM Pro versions 3.1.12 and below. This security flaw enables authenticated users with subscriber-level privileges to induce the host application to initiate arbitrary HTTP requests to unintended destinations.\nThe vulnerability exposes internal network resources, services restricted by firewalls, and metadata endpoints that are typically inaccessible from the external perimeter. Successful exploitation allows an attacker to pivot inside the internal network, potentially leading to unauthorized data exfiltration, internal service enumeration, and further compromise of the underlying infrastructure.\nThe attack requires subscriber-level authentication within the WordPress ecosystem where FluentCRM Pro is installed. The risk implications are severe for organizations hosting sensitive internal services adjacent to the vulnerable web application.",
  "technicalDetails": "The vulnerability resides in the request-handling mechanisms of FluentCRM Pro <= 3.1.12, where user-supplied URLs or endpoints are processed and fetched by the server without adequate input validation, sanitization, or destination restriction.\nRoot Cause: The application fails to implement a robust allowlist or restrict outbound network connections to external, trusted URIs. Consequently, the underlying HTTP client library processes user-controlled input and performs outbound requests to arbitrary IP addresses and port numbers specified by the caller.\nAuthentication and Privileges: Exploitation requires a valid user account with subscriber-level privileges. While subscribers have minimal permissions within standard WordPress installations, the exposed functionality within the plugin improperly grants them the ability to trigger server-side requests.\nAttack Flow: 1. The authenticated attacker crafts a malicious HTTP request targeting a specific feature within FluentCRM Pro that accepts a URL parameter. 2. The attacker submits internal IP addresses (e.g., 127.0.0.1, 169.254.169.254) or internal network hosts in place of external URLs. 3. The server-side component parses the input and initiates a backend HTTP connection to the specified target. 4. The response from the internal resource or metadata service is handled by the application, and depending on the implementation, the output or error details may be returned to the attacker, enabling information disclosure.\nNetwork Exposure: The vulnerability is exploitable over the network via the application's HTTP interface, impacting any deployment utilizing vulnerable versions of FluentCRM Pro."
}