{
 "id": "WPSEC-2026-1636",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1636/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1636/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1636/index.md",
 "title": "Zoho CRM Lead Magnet <= 1.8.2.5 - Cross-Site Request Forgery to Zoho CRM Account Linking via OAuth Callback",
 "description": "The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Zoho OAuth callback handling on the plugin's settings page in all versions up to, and including, 1.8.2.5, due to missing OAuth state validation when the 'code' parameter is processed. The plugin exchanges the code for tokens and overwrites the stored Zoho CRM connection without checking that the logged-in administrator started the flow, and it overwrites the connection even when the exchange fails. This makes it possible for unauthenticated attackers to disconnect the site's Zoho CRM integration or, with an authorization code issued for the site's configured client, link the site to an attacker-controlled Zoho CRM account so captured leads go to the attacker. The attacker must trick a site administrator into clicking a link or taking a similar action.",
 "plugin": {
  "slug": "zoho-crm-forms",
  "name": "Zoho CRM Lead Magnet",
  "full_name": "Zoho CRM Lead Magnet",
  "wordpress_org": "https://wordpress.org/plugins/zoho-crm-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/zoho-crm-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.2.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.2.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.2.6",
 "remediation": "Update to 1.8.2.6 or later.",
 "fix_released": "2026-10-24T06:36:28+00:00",
 "published": "2026-10-25T06:40:42+00:00",
 "updated": "2026-10-24T10:52:44.180990+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1636/",
  "https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.6/",
  "https://wordpress.org/plugins/zoho-crm-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}