CVE-2026-7798

The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.

• CWE-918

• https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L113
• https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L85
• https://plugins.trac.wordpress.org/browser/fluent-crm/tags/2.9.87/app/Hooks/Handlers/ExternalPages.php#L87
• https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L113
• https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L85
• https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php#L87
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3532271%40fluent-crm&new=3532271%40fluent-crm&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0?source=cve

Published

May 22, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7797The Appointment Booking Calendar — Simply Schedule Appointme…7.5
• CVE-2026-77970Cleartext Storage of Sensitive Information vulnerability in …5.9
• CVE-2026-77972Time-of-check Time-of-use (TOCTOU) Race Condition in Slab sa…9
• CVE-2026-77974After spoofing the device and obtaining one user confirmatio…8
• CVE-2026-77975The affected Ebyte product exports administrative credenti…6.5
• CVE-2026-77977Ebyte gateway product's vendor configuration utility does no…8.1
• CVE-2026-77987A server-side request forgery (SSRF) vulnerability was ident…9.3
• CVE-2026-77988A weakness has been identified in TRENDnet TEW-823DRU 1.1.02…6.6
• CVE-2026-77989Joomla Extension - joomlaeventmanager.net - Reflected XSS vi…5.3
• CVE-2026-7799Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-77990Joomla Extension - joomlaeventmanager.net - Attendee lists r…5.3
• CVE-2026-77991Joomla Extension - joomlaeventmanager.net - Privileged remot…9.4