The vulnerability is a classic SQL Injection flaw present in all versions of the FluentCRM Pro WordPress plugin up to and including 3.1.12. It stems from insufficient escaping and the lack of prepared statements for a user‑supplied parameter, enabling an attacker who can authenticate as an Author or higher to inject additional SQL statements. The immediate consequence is the ability to read or potentially manipulate sensitive data stored in the WordPress database, such as customer information, email lists, and campaign records. The impact is limited to data exfiltration and alteration within the plugin’s scope; there is no evidence of remote code execution or system compromise based solely on the supplied description.

All installations of the FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress running versions 3.1.12 or earlier are affected. The vulnerability is present in the plugin’s underlying WordPress code base and does not appear in later releases beyond 3.1.12.

With a CVSS score of 6.5 the flaw represents moderate severity, and its EPSS score is not available. The issue is not listed in the CISA KEV catalog. Because the attack requires authenticated access with at least Author privileges, the likelihood of exploitation depends on the strength of the site’s user management and the number of users with such roles. An unauthenticated user cannot leverage the vulnerability alone, but an attacker who compromises a legitimate Author account or fulfills a social engineering goal can inject malicious queries directly into the plugin’s request flow. The absence of a publicly disclosed exploit does not reduce the risk, as the flaw is easy to exploit once the attacker has credentials.