{
 "id": "WPSEC-2026-2099",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2099/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2099/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2099/index.md",
 "title": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Authenticated (Subscriber+) Authentication Bypass to Contact Takeover via Unverified Email Change",
 "description": "The FluentCRM plugin for WordPress is vulnerable to an authentication bypass in all versions up to, and including, 3.2.6 due to the current contact being matched to the logged-in user by email address without requiring that email to be verified. Because WordPress users can change their own account email without confirmation, this makes it possible for authenticated attackers with subscriber-level access and above to set their email to a victim's address and take over that victim's CRM contact, including viewing and modifying its profile, preferences and personalized data.",
 "plugin": {
  "slug": "fluent-crm",
  "name": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution",
  "full_name": "FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution",
  "wordpress_org": "https://wordpress.org/plugins/fluent-crm/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-crm/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-crm"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.0",
 "remediation": "Update to 3.3.0 or later.",
 "fix_released": "2026-10-29T14:21:34+00:00",
 "published": "2026-10-30T14:47:12+00:00",
 "updated": "2026-10-29T17:47:23.884294+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2099/",
  "https://plugins.svn.wordpress.org/fluent-crm/tags/3.3.0/",
  "https://wordpress.org/plugins/fluent-crm/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-crm",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}