{
 "id": "WPSEC-2026-0815",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0815/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0815/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0815/index.md",
 "title": "Zoho CRM Lead Magnet <= 1.8.2.3 - Improper Certificate Validation via Globally Disabled SSL Verification",
 "description": "The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Improper Certificate Validation in all versions up to, and including, 1.8.2.3. This is due to the plugin registering an http_request_args filter that disables SSL certificate verification for every outbound WordPress HTTP request site-wide. This makes it possible for unauthenticated attackers in a privileged network position to perform man-in-the-middle attacks, intercepting or tampering with outbound traffic such as Zoho OAuth token exchanges and other HTTPS requests made by the site.",
 "plugin": {
  "slug": "zoho-crm-forms",
  "name": "Zoho CRM Lead Magnet",
  "full_name": "Zoho CRM Lead Magnet",
  "wordpress_org": "https://wordpress.org/plugins/zoho-crm-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/zoho-crm-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-295"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.2.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.2.4",
 "remediation": "Update to 1.8.2.4 or later.",
 "fix_released": "2026-10-12T05:58:28+00:00",
 "published": "2026-10-13T06:44:12+00:00",
 "updated": "2026-10-12T09:38:09.537787+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0815/",
  "https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.4/",
  "https://wordpress.org/plugins/zoho-crm-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-13"
 }
}