Privilege Escalation Vulnerability in CRM Memberships Plugin for WordPress

CVE-2025-13313

What is CVE-2025-13313?

The CRM Memberships plugin for WordPress is susceptible to a privilege escalation flaw that permits unauthorized users to reset passwords for any account. This vulnerability arises from inadequate authorization checks in the ntzcrm_changepassword AJAX action, exposing the endpoint to unauthenticated attackers who can reset any user's password given they know or can guess a target user's email. Additionally, the ntzcrm_get_users endpoint is accessible without authentication, enabling attackers to enumerate subscriber email addresses, thereby increasing their chances of exploiting this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References