Unauthorized Data Modification in CRM Plugin for WordPress

CVE-2025-5692

What is CVE-2025-5692?

The Lead Form Data Collection to CRM plugin for WordPress is susceptible to unauthorized data modification. This occurs due to a missing capability check in the doFieldAjaxAction() function, affecting all versions up to and including 3.1. Authenticated attackers, with Subscriber-level privileges or higher, can exploit this vulnerability to alter settings within the WordPress site. They can manipulate critical options such as changing the default registration role to an administrator and enable user registration, potentially allowing attackers to gain administrative access to the vulnerable site. Other AJAX actions associated with plugin settings also lack sufficient protection, further increasing the risk.

References