This vulnerability, identified as CWE-918 SSRF, exists in FluentCRM Pro versions up to 3.1.12. It allows an attacker with low privileges to induce the server to send crafted requests to internal or external resources, potentially exposing sensitive information or manipulating data. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impacts. No vendor advisory or patch information is currently provided.

The SSRF vulnerability could allow an attacker to make the server perform unauthorized requests, which may lead to limited disclosure of sensitive information and modification of data integrity. There is no indication of availability impact. The attack requires low privileges but has high complexity, reducing the likelihood of exploitation. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to server requests. Avoid exposing the vulnerable functionality to untrusted users.