FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.0 - Authenticated (Custom Contact-Read Access) Sensitive Information Exposure via Contact Email History

ID

WPSEC-2026-0103

Plugin

FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution (fluent-crm)

Affected

from 2.0.0 before 3.2.5

Remediation

Update to 3.2.5 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22

Attack surface

FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution on WPSec AttackSurface

Fix released

2026-09-30

Published

2026-10-01

Description

The FluentCRM plugin for WordPress is vulnerable to Sensitive Information Exposure via the contact emails history endpoint in all versions up to, and including, 3.2.0 due to the endpoint returning full campaign email records to CRM users who can read contacts but lack the permission to manage contacts. This makes it possible for authenticated users granted read-only contact access to view rendered email bodies, email headers, and the hashes that unlock public email previews.

References

• https://wpsec.com/vuln/WPSEC-2026-0103/
• https://plugins.svn.wordpress.org/fluent-crm/tags/3.2.5/
• https://wordpress.org/plugins/fluent-crm/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS