Authorization and CSRF Bypass in HelloLeads CRM Form Shortcode Plugin
CVE-2025-12696
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 December 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-12696?
The HelloLeads CRM Form Shortcode plugin for WordPress lacks proper authorization and CSRF validation mechanisms. This flaw enables unauthorized users to reset settings without authentication, potentially leading to significant changes in the plugin's operation. Users of this plugin should take immediate action to apply security updates and mitigate the risk of exploitation.
Affected Version(s)
HelloLeads CRM Form Shortcode 0 <= 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.