PT-2025-51149 · WordPress · Helloleads Crm Form Shortcode Wordpress Plugin

Khaled Alenazi · Published 2025-12-14 · Updated 2025-12-14 · CVE-2025-12696

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HelloLeads CRM Form Shortcode WordPress plugin versions through 1.0

Description The HelloLeads CRM Form Shortcode WordPress plugin does not properly verify authorization or include CSRF protection when resetting its settings. This allows unauthenticated users to reset the plugin’s settings.

Recommendations Update HelloLeads CRM Form Shortcode WordPress plugin to a version beyond 1.0.

Exploit

Fix

Related Identifiers

CVE-2025-12696

Affected Products

Helloleads Crm Form Shortcode Wordpress Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/e552dfc8-c6e1-4605-bc36-30dc4066eaea · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12696 · Security Note
• https://t.me/cveNotify/145693 · Telegram Post
• https://t.me/CVEtracker/39756 · Telegram Post
• https://twitter.com/CVEnew/status/2000246119234678787 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000095287482663087 · Twitter Post