{
 "id": "WPSEC-2026-0813",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0813/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0813/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0813/index.md",
 "title": "Zoho CRM Lead Magnet <= 1.8.2.3 - Missing Authorization to Authenticated (Subscriber+) Contact Form Field Mapping and CRM User Disclosure",
 "description": "The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the zcf_get_contactform_fields AJAX action in all versions up to, and including, 1.8.2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the plugin's contact form field mapping data, including the email addresses of the connected Zoho CRM users and form field names taken from the content of arbitrary posts.",
 "plugin": {
  "slug": "zoho-crm-forms",
  "name": "Zoho CRM Lead Magnet",
  "full_name": "Zoho CRM Lead Magnet",
  "wordpress_org": "https://wordpress.org/plugins/zoho-crm-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/zoho-crm-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.2.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.2.4",
 "remediation": "Update to 1.8.2.4 or later.",
 "fix_released": "2026-10-12T05:58:28+00:00",
 "published": "2026-10-13T06:44:12+00:00",
 "updated": "2026-10-12T09:38:09.537787+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0813/",
  "https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.4/",
  "https://wordpress.org/plugins/zoho-crm-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}