CVE-2026-78270: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WP ManageNinja LLC FluentCRM Pro

CVE-2026-78270 is an SQL Injection vulnerability (CWE-89) in FluentCRM Pro versions <= 3.1.12. The vulnerability arises from improper neutralization of special elements used in SQL commands related to author input, allowing an attacker with high privileges to execute arbitrary SQL queries. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is published and tracked by Patchstack but currently lacks an official fix or remediation level. The product is not a cloud service, so remediation depends on vendor patch releases.

An attacker with high privileges on the system could exploit this SQL Injection vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted according to the CVSS vector. The scope of the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor vendor communications for updates and consider restricting high privilege access until a patch is available.