CVE-2025-5692

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5692", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-04T20:04:29.128Z", "datePublished": "2025-07-02T02:03:53.387Z", "dateUpdated": "2026-04-08T16:42:41.444Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:41.444Z"}, "affected": [{"vendor": "smackcoders", "product": "Lead Form Data Collection to CRM", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates."}], "title": "Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26404b5c-a0f2-4223-be61-1f03873666fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-leads-builder-any-crm/trunk/includes/Functions.php#L423"}, {"url": "https://wordpress.org/plugins/wp-leads-builder-any-crm/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319750%40wp-leads-builder-any-crm&new=3319750%40wp-leads-builder-any-crm&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2025-06-20T07:21:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-01T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-02T13:01:32.622634Z", "id": "CVE-2025-5692", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T13:19:20.933Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5692", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-02T13:01:32.622634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-02T13:05:28.766Z"}}], "cna": {"title": "Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "smackcoders", "product": "Lead Form Data Collection to CRM", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-20T07:21:42.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-01T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26404b5c-a0f2-4223-be61-1f03873666fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-leads-builder-any-crm/trunk/includes/Functions.php#L423"}, {"url": "https://wordpress.org/plugins/wp-leads-builder-any-crm/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319750%40wp-leads-builder-any-crm&new=3319750%40wp-leads-builder-any-crm&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:41.444Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5692", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:41.444Z", "dateReserved": "2025-06-04T20:04:29.128Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-02T02:03:53.387Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Lead Form Data Collection to CRM", "vendor": "smackcoders", "versions": [{"lessThanOrEqual": "3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:smackcoders:lead_form_data_collection_to_crm:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "82151018-3D96-4669-9A8B-0DE8D7D08BB3", "versionEndExcluding": "3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates."}, {"lang": "es", "value": "El complemento Lead Form Data Collection to CRM de WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos, lo que puede provocar una escalada de privilegios debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n doFieldAjaxAction() en todas las versiones hasta la 3.1 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, actualicen opciones arbitrarias en el sitio de WordPress. Esto puede aprovecharse para actualizar el rol predeterminado de registro a administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso administrativo a un sitio vulnerable. Otras acciones AJAX que gestionan la configuraci\u00f3n del complemento tambi\u00e9n carecen de protecci\u00f3n suficiente y son vulnerables a ataques."}], "id": "CVE-2025-5692", "lastModified": "2026-06-17T09:48:33.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5692", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-02T13:01:32.622634Z", "version": "2.0.3"}}]}, "published": "2025-07-02T03:15:23.680", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/wp-leads-builder-any-crm/trunk/includes/Functions.php#L423"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319750%40wp-leads-builder-any-crm&new=3319750%40wp-leads-builder-any-crm&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/wp-leads-builder-any-crm/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26404b5c-a0f2-4223-be61-1f03873666fb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:10:35.633945+00:00", "value": {"mitigation_remediation": ["Upgrade the Lead Form Data Collection to CRM plugin to a version newer than 3.1 that includes the missing capability check.", "If an immediate upgrade is not possible, modify the plugin\u2019s capability checks or remove the affected AJAX endpoints for users below the Administrator role to prevent unauthorized access.", "Review and limit the capabilities granted to Subscriber or lower roles, ensuring they do not include administrative privileges required by the plugin\u2019s settings functions."], "summary": {"action": "Update Plugin", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "This issue affects the Lead Form Data Collection to CRM plugin from SmackCoders, all releases up to and including version 3.1 on WordPress installations. Systems running any of these versions with a web interface and a valid subscriber or higher user account are vulnerable.", "description_and_impact": "The Lead Form Data Collection to CRM plugin has a missing capability check in its AJAX handling file, which allows users with Subscriber-level access and above to invoke privileged actions such as updating plugin settings. This flaw falls under the missing authorization category and can be used by an attacker who is already authenticated on the site to change configuration data. The vulnerability does not grant direct code execution but elevates the attacker\u2019s influence within the site\u2019s settings.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a medium severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attack vector is most likely web-based, requiring an attacker to be authenticated with at least a Subscriber role and to send crafted AJAX requests to the LB_admin_ajax.php endpoint. No additional local privileges are needed beyond the normal Subscriber permissions."}}}}, "created": "2026-04-22T17:15:22.200990+00:00", "updated": "2026-04-22T17:15:22.201005+00:00", "vendors": []}