Elementor Zoho CRM CVE-2026-9734

The plugin must be installed and active on a WordPress site. The attacker must successfully trick a currently authenticated WordPress site administrator into visiting an attacker-controlled web page or clicking a crafted link - this is the UI:R interaction required by the CVSS vector and the primary exploitation barrier. No special plugin configuration beyond basic installation is required; the storeInfo function is reachable in default plugin deployments. Limiting factors: the attack cannot be executed without administrator participation (rules out fully automated scanning and exploitation); the attacker gains control over CRM integration settings only, not WordPress credentials, database access, or filesystem execution; and the attacker must already know the target site's WordPress admin-ajax URL (trivially discoverable but still a minor friction point). Sites where administrators do not regularly click external links, or where admin access is IP-restricted, are materially harder to target.

The official CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) accurately captures the constrained real-world impact. The UI:R metric is the critical limiting factor: exploitation requires an authenticated WordPress administrator to actively follow a malicious link, introducing a meaningful social engineering hurdle. No EPSS score was provided in the available data, so probability of exploitation in the wild cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified, making this a low-urgency item absent a targeted campaign. The integrity impact is narrow - limited to Zoho CRM integration settings - with no confidentiality breach, no code execution, and no availability impact. This is a genuine-but-low-priority issue: real risk exists for sites actively using the plugin for CRM data capture, where credential hijacking could silently exfiltrate customer data into a third-party Zoho account, but the attack is not scalable or automated without user interaction.

An attacker crafts an HTML page containing a hidden form that submits a POST request to the target WordPress site's admin AJAX endpoint, targeting the storeInfo function with attacker-controlled Zoho credentials. The attacker sends a phishing email to the site administrator containing a plausible pretext (e.g., a fake plugin update notice) with a link to this page. When the administrator - currently logged into the WordPress dashboard - follows the link, their browser automatically sends the forged request with their valid session cookie, silently replacing the legitimate Zoho CRM credentials with the attacker's, after which all subsequent CRM form submissions from the site are routed to the attacker's Zoho account.