The FluentCRM plugin for WordPress contains a blind server‑side request forgery (SSRF) vulnerability that is triggered by supplying a crafted SubscribeURL parameter. An attacker who can send unauthenticated requests can cause the application to perform HTTP requests to arbitrary internal or external addresses. The flaw can be used to probe the application’s network, exfiltrate data, or modify information on internal services, as it satisfies the modern definition of a blind SSRF (CWE‑918).

All releases of the FluentCRM plugin up to and including version 2.9.87 are affected. The vulnerability is present in the WordPress plugin repository under the vendor name TechJewel. Users running any of these versions on a WordPress site are at risk if the site has not yet applied an update beyond 2.9.87.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not catalogued in CISA’s KEV list. Exploitation requires that the SES bounce handling key '_fc_bounce_key' has never been configured, which is true for a site that remains in its default state. When that key is present, the authentication check prevents the SSRF from succeeding. Based on the description, it is inferred that if an attacker can keep the site in the unconfigured default state, they could leverage the blind SSRF to query internal network services or modify them. The attack vector is an unauthenticated HTTP request to the plugin’s external page handler.