Critical · published December 5, 2025
🚨 Unauthenticated attackers can reset any user password thanks to a sneaky oversight in the CRM Memberships plugin for WordPress! 🔥 Think of it like a restaurant with a sign-out front saying, 'Anyone can change the reservation!' without checking who’s at the door. All it takes is someone spotting a name on the list to walk in and take over a table, or in this case, an account. An attacker could waltz in, reset passwords for any user with accessible email addresses, and gain full control over their accounts. This is a serious breach of privacy that could lead to unauthorized actions, data leaks, and a devastating loss of trust.
Think of it like a restaurant with a sign-out front saying, 'Anyone can change the reservation!' without checking who’s at the door. All it takes is someone spotting a name on the list to walk in and take over a table, or in this case, an account. The vulnerability arises from missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX action, allowing attackers to reset passwords without any validation. Additionally, the `ntzcrm_get_users` endpoint is exposed, letting unauthorized users enumerate subscriber email addresses, making exploitation straightforward.
An attacker could waltz in, reset passwords for any user with accessible email addresses, and gain full control over their accounts. This is a serious breach of privacy that could lead to unauthorized actions, data leaks, and a devastating loss of trust. To protect against this vulnerability, update the CRM Memberships plugin to version 2.6.1 or newer. Implement proper authentication protocols for all AJAX actions related to sensitive user data. Regularly audit your plugins for vulnerabilities and keep them updated! You've got this! Following these steps will help secure your site in no time. 🛡️