Description
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
Published: 2026-08-24
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection leading to database compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a classic SQL injection flaw (CWE-89) in the WordPress FluentCRM Pro plugin version 3.1.12 and earlier. Unvalidated input reaches the database layer, allowing an attacker to inject malicious SQL statements. This can result in unauthorized data retrieval, modification, or deletion, potentially granting full control over the WordPress site's database.

Affected Systems

The flaw affects the FluentCRM Pro plugin developed by WP ManageNinja LLC. All installations running version 3.1.12 or older are vulnerable. WordPress sites that rely on the plugin for customer relationship management without applying the patch remain at risk.

Risk and Exploitability

The CVSS score of 7.6 indicates a high severity. This flaw is a classic SQL injection (CWE-89). The EPSS score is not available, so exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. A likely attack vector is via the plugin's publicly exposed interfaces; if a site is accessible over the internet, an attacker can send crafted requests to trigger the injection. The impact could lead to loss of confidentiality or integrity for site data.

Generated by OpenCVE AI on August 24, 2026 at 12:52 UTC.

Remediation

Vendor Solution

Update the WordPress FluentCRM Pro Plugin to the latest available version (at least 3.1.13).

OpenCVE Recommended Actions

  • Update the FluentCRM Pro plugin to version 3.1.13 or later, which removes the SQL injection vulnerability (CWE-89) code.
  • Ensure that only trusted administrators have access to the WordPress admin area and disable the plugin for untrusted user accounts if the update cannot be applied immediately.
  • Deploy a web application firewall or intrusion detection system that inspects SQL patterns to mitigate potential exploitation during the transition period.

Generated by OpenCVE AI on August 24, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpmanageninja
Wpmanageninja fluentcrm
Vendors & Products Wordpress
Wordpress wordpress
Wpmanageninja
Wpmanageninja fluentcrm

Mon, 24 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
Title WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Wordpress Wordpress
Wpmanageninja Fluentcrm
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-24T12:51:10.833Z

Reserved: 2026-08-24T07:37:56.725Z

Link: CVE-2026-78270

cve-icon Vulnrichment

Updated: 2026-08-24T12:50:17.845Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T12:16:55.043

Modified: 2026-08-24T16:40:53.647

Link: CVE-2026-78270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:45:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')