CVE-2022-41978 HIGH

CVE-2022-41978: WordPress Zoho CRM Lead Magnet plugin <= 1.7.5.8 - Auth. Arbitrary Options Update vulnerability

Vendor Zoho Crm
Product Zoho CRM Lead Magnet (WordPress plugin)
Weakness CWE-264
Published November 9, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Zoho CRM Lead Magnet WordPress plugin version 1.7.5.8 and earlier contains an authorization flaw that allows authenticated users with low privileges to read, modify, or delete sensitive data and configuration. An attacker with a standard user account can escalate their access to perform actions restricted to administrators, potentially compromising the entire CRM integration and customer data stored through the plugin.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete CRM data and plugin settings with a low-privilege user account.

Potential impact on your site

04Site Impact

Customer data in Zoho CRM and plugin configuration can be accessed or altered by any logged-in user, not just administrators.

Conditions required to exploit

05Prerequisites

Attacker needs a valid WordPress user account with low privileges (subscriber or contributor level).

Key dates

06Disclosure timeline

November 9, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-41781 WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability CVE-2022-41132 WordPress Ezoic plugin <= 2.8.8 - Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability CVE-2022-34149 WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability CVE-2022-37344 WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerability CVE-2022-36387 WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability