EUVD-2026-45354
GHSA-qx49-qxg3-x53g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker needs no credentials (PR:N), but admin must click a link (UI:R); impact is confined to integrity of CRM settings (I:L) with no confidentiality or availability loss.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-site request forgery in the W3SC Elementor to Zoho CRM WordPress plugin (all versions through 2.2.0) permits unauthenticated attackers to overwrite the site's Zoho CRM integration credentials - including the configured data center, client ID, client secret, and user email - with attacker-controlled values. Exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted link, after which the attacker can silently redirect the site's CRM submissions to their own Zoho account. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; risk is moderated by the mandatory user-interaction prerequisite.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) describes a class of flaw where a web application performs state-changing actions based solely on authenticated session cookies, without verifying that the request originated from a legitimate user interaction. WordPress mitigates this class with nonces - short-lived tokens embedded in forms and AJAX handlers. The vulnerable plugin fails to validate or entirely omits nonce checks on its storeInfo function, as evidenced by the NVD-linked source references in Authdata.php (lines 33 and 38) and Setting.php (line 23). These files govern how the plugin stores Zoho OAuth credentials and CRM data center configuration. The plugin bridges Elementor (a widely-used WordPress page builder) with Zoho CRM via OAuth, making the stored client ID, client secret, and user email high-value targets - compromising them can redirect CRM data streams to an attacker-controlled Zoho tenant. No CPE string was provided in the input data.
RemediationAI
No patched version number is confirmed in the available data - check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b99ba627-1d24-4be1-a4db-ff39354526f2?source=cve) and the WordPress plugin repository for a released fix and upgrade to the latest available version immediately if one exists. As a compensating control pending a patch, administrators should deactivate and remove the plugin if Zoho CRM integration is not actively required, eliminating the attack surface entirely. If the plugin must remain active, restrict WordPress admin access to known IP ranges via server-level controls (e.g., nginx allow/deny directives on /wp-admin and /wp-login.php), which reduces the attacker's ability to target an authenticated session. Additionally, train administrators to treat unsolicited links - particularly those directing to the WordPress dashboard or plugin settings - with suspicion. Note that IP restriction may cause access issues for administrators working remotely and should be coordinated with operational teams.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today