The FluentCRM WordPress plugin contains a Blind SSRF vulnerability (CWE-918) exploitable via the 'SubscribeURL' parameter in versions up to 2.9.87. Unauthenticated attackers can leverage this flaw to induce the server to make arbitrary HTTP requests to internal or external systems. The vulnerability requires that the SES bounce handling key ('_fc_bounce_key') has not been set, which is the case before the bounce configuration page is accessed. This key acts as an authentication check to block unauthorized SSRF attempts once configured. No official fix or patch has been documented, and the vulnerability remains exploitable in default/unconfigured installations.

Successful exploitation allows unauthenticated attackers to perform SSRF attacks, potentially querying and modifying internal services accessible from the server hosting the plugin. This could lead to partial disclosure and modification of sensitive internal information. The impact is limited by the requirement that the SES bounce handling key is not set, which is typically only true in default or unconfigured states. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should ensure the SES bounce handling key ('_fc_bounce_key') is generated by visiting and completing the bounce configuration page in FluentCRM, as this prevents unauthenticated SSRF exploitation. Monitoring for plugin updates and applying them promptly when released is recommended.