PT-2025-49192 · WordPress · Wordpress Crm Memberships
Athiwat Tiprasaharn
·
Published
2025-12-05
·
Updated
2025-12-10
·
CVE-2025-13313
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WordPress CRM Memberships plugin versions up to and including 2.5
Description
The CRM Memberships plugin for WordPress is susceptible to privilege escalation through a password reset function. The issue stems from a lack of proper authorization and authentication checks on the
ntzcrm changepassword AJAX action. This allows unauthenticated attackers to reset passwords for any user, gaining unauthorized access to accounts, provided they have access to the user's email address. The plugin also exposes the ntzcrm get users endpoint without authentication, enabling attackers to enumerate subscriber email addresses, which can be used to facilitate exploitation of the password reset issue. The vulnerable API endpoints are /ntzcrm changepassword and /ntzcrm get users. The ntzcrm changepassword endpoint is used for password resets, and the ntzcrm get users endpoint allows for the retrieval of user information.Recommendations
Versions prior to and including 2.5 should be updated. As a temporary workaround, consider disabling the
ntzcrm changepassword AJAX action until a patch is available. Restrict access to the ntzcrm get users endpoint to minimize the risk of email address enumeration.Fix
LPE
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wordpress Crm Memberships