An authenticated SQL injection vulnerability in the FluentCRM Pro plugin could allow authorized authors to manipulate database queries and potentially access sensitive data.

This vulnerability is a SQL injection (CWE-89) that occurs due to insufficient input validation. It requires high-privileged (Author) access, allowing the attacker to interact with the backend database in an unauthorized manner.

The vulnerability allows for potential data exfiltration from the CRM database, which often contains highly sensitive customer information and marketing data. With a CVSS score of 7.6, the risk of data compromise is significant, potentially leading to regulatory non-compliance and reputational damage.

Immediate Action: Update the FluentCRM Pro plugin to version 3.1.13 or later immediately.

Proactive Monitoring: Review database logs for unusual query activity and audit the permissions of all accounts with Author-level access.

Compensating Controls: Utilize a Web Application Firewall to filter malicious SQL syntax from incoming HTTP requests.

Public Exploit Available: No (exploit_available: false)

Security teams must prioritize updating this plugin to the latest version. Given the high-privilege requirement, it is also recommended to review existing user roles within the WordPress environment to ensure that only trusted personnel hold Author-level access.