CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
Explanation of Vulnerability in Simple Terms
Lead Form Data Collection to CRM versions 3.1 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data. An attacker with a basic user account can access form submissions, CRM records, and configuration settings without restriction. This affects all installations running the vulnerable version range.
What an attacker can do
Read, modify, or delete form submissions and CRM data with a low-privilege user account.
Potential impact on your site
Form submissions and CRM records are exposed to any authenticated user, risking data breach and unauthorized modifications.
Conditions required to exploit
Attacker must have a valid user account with low privileges on the site.
Key dates
External resources
