Is CVE-2026-78277 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78277 being exploited in the wild.

How severe is CVE-2026-78277?

Medium severity, with a CVSS score of 4.9, published 24 August 2026.

Which products and versions are affected?

WP ManageNinja LLC FluentCRM Pro <= 3.1.12.

Is there a fix for CVE-2026-78277?

A patch was published on 2026-08-24: Version 3.1.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78277 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78277?

Check whether you run WP ManageNinja LLC FluentCRM Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78277: FluentCRM Pro subscriber SSRF vulnerability

Q: Is there a fix for CVE-2026-78277?

A patch was published on 2026-08-24: Version 3.1.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-78277 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-78277?

Check whether you run WP ManageNinja LLC FluentCRM Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78277 · Severity: medium · CVSS 4.9 · Published 2026-08-24

FluentCRM Pro is a WordPress plugin for customer relationship management and email campaigns. An attacker with a subscriber account can exploit a server-side request forgery (SSRF) vulnerability to make the server connect to internal systems and potentially leak sensitive data from behind the firewall or access resources not normally exposed to the internet.

Vendors: WP ManageNinja LLC.

Quick answers

Is CVE-2026-78277 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78277 being exploited in the wild.
How severe is CVE-2026-78277?: Medium severity, with a CVSS score of 4.9, published 24 August 2026.
Which products and versions are affected?: WP ManageNinja LLC FluentCRM Pro <= 3.1.12.
Is there a fix for CVE-2026-78277?: A patch was published on 2026-08-24: Version 3.1.13 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78277 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78277?: Check whether you run WP ManageNinja LLC FluentCRM Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability in FluentCRM Pro versions up to 3.1.12 allows authenticated subscriber-level users to forge requests from the vulnerable server to internal or restricted resources. The vulnerability requires subscriber-level authentication to exploit. By crafting malicious requests, attackers can bypass network access controls, probe internal services, and potentially exfiltrate sensitive data. The vulnerability has been patched in version 3.1.13.

Affected products

WP ManageNinja LLC FluentCRM Pro <= 3.1.12

Timeline

2026-08-24: disclosed: Published by Patchstack
2026-08-24: patched: Version 3.1.13 available

References

https://patchstack.com/database/wordpress/plugin/fluentcampaign-pro/vulnerability/wordpress-fluentcrm-pro-plugin-3-1-12-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.