PT-2025-49191 · WordPress · Crm Memberships

Athiwat Tiprasaharn · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-13312

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CRM Memberships plugin for WordPress versions prior to 2.6

Description The CRM Memberships plugin for WordPress is susceptible to unauthorized membership tag creation. This is due to a missing capability check within the ntzcrm add new tag() function. This allows unauthenticated attackers to create arbitrary membership tags and modify CRM configuration intended for administrators only.

Recommendations Update the CRM Memberships plugin to version 2.6 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13312

Affected Products

Crm Memberships

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13312 · Security Note
• https://plugins.trac.wordpress.org/browser/crm-memberships/tags/2.5/includes/class/class-ntzcrm-api.php#L828 · Note
• https://twitter.com/CVEnew/status/1996841716574457965 · Twitter Post
• https://plugins.trac.wordpress.org/browser/crm-memberships/tags/2.5/includes/class/class-ntzcrm-api.php#L14 · Note
• https://t.me/cveNotify/144832 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f61b9de5-5c37-4efb-ad1c-006e9fc05bc2?source=cve · Note