Vulnerabilities / Zoho CRM Lead Magnet / WPSEC-2026-0815
Zoho CRM Lead Magnet <= 1.8.2.3 - Improper Certificate Validation via Globally Disabled SSL Verification
Medium 4.8
CWE-295Fixed in 1.8.2.4
- ID
- WPSEC-2026-0815
- Plugin
- Zoho CRM Lead Magnet (zoho-crm-forms)
- Affected
- all versions before 1.8.2.4
- Remediation
- Update to 1.8.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-295
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Zoho CRM Lead Magnet on WPSec AttackSurface
- Fix released
- Published
Description
The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Improper Certificate Validation in all versions up to, and including, 1.8.2.3. This is due to the plugin registering an http_request_args filter that disables SSL certificate verification for every outbound WordPress HTTP request site-wide. This makes it possible for unauthenticated attackers in a privileged network position to perform man-in-the-middle attacks, intercepting or tampering with outbound traffic such as Zoho OAuth token exchanges and other HTTPS requests made by the site.
References
- https://wpsec.com/vuln/WPSEC-2026-0815/
- https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.4/
- https://wordpress.org/plugins/zoho-crm-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS