PT-2025-27582 · WordPress · Lead Form Data Collection To Crm

Youcef Hamdani · Published 2025-07-02 · Updated 2025-08-27 · CVE-2025-5692

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Lead Form Data Collection to CRM plugin for WordPress versions up to, and including, 3.1

Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the doFieldAjaxAction() function. This enables authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site, potentially updating the default role for registration to administrator and enabling user registration for attackers to gain administrative user access.

Recommendations: For versions up to, and including, 3.1, update to a version that includes a fix for the missing capability check in the doFieldAjaxAction() function. As a temporary workaround, consider disabling the doFieldAjaxAction() function until a patch is available. Restrict access to AJAX actions handling plugin settings to minimize the risk of exploitation.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-5692

Affected Products

Lead Form Data Collection To Crm

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-5692 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5692 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319750%40wp-leads-builder-any-crm&new=3319750%40wp-leads-builder-any-crm&sfp_email=&sfph_mail= · Patch
• https://plugins.trac.wordpress.org/browser/wp-leads-builder-any-crm/trunk/includes/Functions.php#L423 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/26404b5c-a0f2-4223-be61-1f03873666fb?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1940250772614111461 · Twitter Post
• https://twitter.com/cracbot/status/1942176812584595768 · Twitter Post
• https://twitter.com/CVEnew/status/1940256812550291680 · Twitter Post
• https://wordpress.org/plugins/wp-leads-builder-any-crm · Note
• https://t.me/cveNotify/133682 · Telegram Post
• https://t.me/cvenotify/127340 · Telegram Post