What is the CVSS score of CVE-2025-13313?

CVE-2025-13313 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of CRM Memberships are affected by CVE-2025-13313?

The CRM Memberships plugin for WordPress (versions ≤2.5) contains an unauthenticated account-takeover flaw allowing remote password reset of any user account, directly threatening admin access and…

How to fix or mitigate CVE-2025-13313?

Within 24 hours: deactivate the CRM Memberships plugin immediately on all WordPress sites running version 2.5 or earlier. Within 7 days: review user authentication logs for the past 60 days to detect unauthorized password resets or suspicious admin logins; reset passwords for all users, prioritizing administrators. Within 30 days: monitor the vendor's security advisories for a patched version; deploy immediately upon release or switch to an alternative CRM solution if the vendor delays.

CRM Memberships CVE-2025-13313

EUVD-2025-201340 CRITICAL

Missing Authorization (CWE-862)

2025-12-05 security@wordfence.com

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable AJAX actions (AV:N/AC:L/PR:N/UI:N) allow arbitrary account password reset, yielding full compromise of victim accounts (C:H/I:H/A:H, scope unchanged).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:08 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201340

CVE Published

Dec 05, 2025 - 05:16 nvd

CRITICAL 9.8

DescriptionCVE.org

The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.5. This is due to missing authorization and authentication checks on the ntzcrm_changepassword AJAX action. This makes it possible for unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts via the ntzcrm_changepassword endpoint, granted they can obtain or enumerate a target user's email address. The plugin also exposes the ntzcrm_get_users endpoint without authentication, allowing attackers to enumerate subscriber email addresses, facilitating the exploitation of the password reset vulnerability.

AnalysisAI

Unauthenticated privilege escalation via password reset in the CRM Memberships plugin for WordPress (versions ≤2.5) lets remote attackers take over any user account. The ntzcrm_changepassword AJAX action lacks both authentication and authorization (nonce/capability) checks, so anyone who knows or enumerates a victim's email can set that account's password; a companion unauthenticated ntzcrm_get_users endpoint leaks subscriber emails to make targeting trivial. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the flaw is remotely triggerable with no user interaction.

Technical ContextAI

The vulnerability lives in the plugin's AJAX API surface (class-ntzcrm-api.php) which registers handlers via WordPress's wp_ajax_nopriv_* hook family, exposing them to unauthenticated visitors. CWE-862 (Missing Authorization) is the root cause: the ntzcrm_changepassword handler performs a password change (ultimately a database write, cf. class-ntzcrm-dbquery.php) without verifying a nonce, the caller's identity, or any capability tying the caller to the target account. WordPress AJAX actions are only safe when developers gate nopriv endpoints with explicit auth/nonce logic; here the state-changing account operation is reachable by any client hitting /wp-admin/admin-ajax.php. The ntzcrm_get_users endpoint compounds this by returning user records (email addresses) to anonymous callers, converting a 'need the victim email' precondition into a self-serve enumeration step.

RemediationAI

Upgrade the CRM Memberships plugin to a version later than 2.5 once the vendor publishes a fixed release; the changeset at https://plugins.trac.wordpress.org/changeset/3464130/ reflects the upstream code change, so treat that as 'upstream fix available; released patched version should be confirmed against the plugin's changelog before deploying.' If an updated version is not yet installable, deactivate and remove the plugin as the only reliable mitigation, since the exposure is in unauthenticated AJAX handlers. As compensating controls, block or restrict access to /wp-admin/admin-ajax.php requests carrying action=ntzcrm_changepassword and action=ntzcrm_get_users at a WAF or reverse proxy (trade-off: rules must match the exact action names and legitimate plugin functionality using those actions will break), and monitor for anomalous password-change and user-enumeration traffic. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e2837399-c44f-494e-bdc6-f9c6e4e2dc11?source=cve) for detection and virtual-patching guidance.