Vulnerabilities / Zoho CRM Lead Magnet / WPSEC-2026-0813
Zoho CRM Lead Magnet <= 1.8.2.3 - Missing Authorization to Authenticated (Subscriber+) Contact Form Field Mapping and CRM User Disclosure
Medium 4.3
CWE-862Fixed in 1.8.2.4
- ID
- WPSEC-2026-0813
- Plugin
- Zoho CRM Lead Magnet (zoho-crm-forms)
- Affected
- all versions before 1.8.2.4
- Remediation
- Update to 1.8.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Zoho CRM Lead Magnet on WPSec AttackSurface
- Fix released
- Published
Description
The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the zcf_get_contactform_fields AJAX action in all versions up to, and including, 1.8.2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the plugin's contact form field mapping data, including the email addresses of the connected Zoho CRM users and form field names taken from the content of arbitrary posts.
References
- https://wpsec.com/vuln/WPSEC-2026-0813/
- https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.4/
- https://wordpress.org/plugins/zoho-crm-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS