HelloLeads CRM Form CVE-2025-12696

Exploitation requires only that the HelloLeads CRM Form Shortcode plugin (version 1.0 or earlier) is installed and active on a reachable WordPress site; the vulnerable action is the plugin's settings-reset function, which lacks both an authorization capability check and a CSRF nonce. Per the CVSS vector (PR:N/UI:N), no authentication and no victim interaction are needed - an unauthenticated remote actor can invoke the reset directly against a default installation. The principal limiting factors are the plugin's narrow deployment footprint and the confined impact: exploitation only resets plugin settings (I:L) and cannot read data (C:N) or affect availability (A:N) of the broader system.

This is a genuine-but-low-severity issue, best characterized as a high-reach-low-impact defect rather than a critical priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation with no user interaction, which is why the base score reaches 5.3 (MEDIUM) despite the limited impact profile (C:N/I:L/A:N) - the only consequence is unauthorized reset of plugin settings (integrity-only). All exploitation signals point the same direction and do not conflict: EPSS is very low at 0.14% (3rd percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is indicated in the supplied intelligence. The one minor tension worth noting is that the description frames the flaw as a CSRF/missing-authorization issue (which classically implies tricking a victim), yet the CVSS vector sets UI:N and PR:N, meaning the reset can be triggered directly by an unauthenticated actor without needing a logged-in admin to be socially engineered - this makes it more directly reachable than a pure CSRF but keeps impact confined to a settings reset. Bottom line: real and remotely reachable, but low real-world risk; patch in normal maintenance cycles rather than as an emergency.

An unauthenticated attacker sends a crafted web request to the vulnerable settings-reset endpoint of a WordPress site running HelloLeads CRM Form Shortcode (≤1.0), and because no authorization or CSRF check is enforced, the plugin's configuration is reset to defaults. This could disrupt lead-capture forms or clear custom configuration, but does not expose data or grant code execution. No public exploit code is identified at time of analysis, though the trivial nature of the request (AV:N/AC:L/PR:N/UI:N) means weaponization would be straightforward.