{
 "id": "WPSEC-2026-2098",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2098/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2098/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2098/index.md",
 "title": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Authenticated (Custom-level Automation Access) PHP Object Injection via Automation Step Settings and Conditions",
 "description": "The FluentCRM plugin for WordPress is vulnerable to PHP Object Injection via automation step settings and conditions in all versions up to, and including, 3.2.6, due to string values from automation import and save requests being stored unchanged and later passed to maybe_unserialize() without restricting allowed classes. This makes it possible for authenticated attackers who have been granted FluentCRM automation write access to inject a PHP object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "fluent-crm",
  "name": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution",
  "full_name": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution",
  "wordpress_org": "https://wordpress.org/plugins/fluent-crm/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-crm/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-crm"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.0",
 "remediation": "Update to 3.3.0 or later.",
 "fix_released": "2026-10-29T14:21:34+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-29T17:47:23.884294+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2098/",
  "https://plugins.svn.wordpress.org/fluent-crm/tags/3.3.0/",
  "https://wordpress.org/plugins/fluent-crm/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-crm",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}