WordPress EUVD-2025-201340

We need to produce a JSON object with the specified fields, synthesizing all provided intelligence. Let's carefully process each piece.

• CVE ID: CVE-2025-13313
• Description: CRM Memberships plugin for WordPress, privilege escalation via password reset, missing auth checks on ntzcrm_changepassword AJAX action, unauthenticated attackers can reset any user's password if they can obtain/enumerate target email. Also ntzcrm_get_users endpoint allows unauthenticated enumeration of subscriber emails. Versions up to 2.5 affected. CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-862 Missing Authorization.
• EPSS: 0.29%, percentile 52%.
• KEV: Not mentioned, so assume false.
• Patch: In References, there is a changeset link: https://plugins.trac.wordpress.org/changeset/3464130/ — likely the fix. But no version number provided. The EUVD says affected versions "CRM Memberships * ≤2.5". So inferred that patched version would be above 2.5, maybe 2.5.1? Not stated explicitly. We'll note upstream fix available, patched version not independently confirmed.
• Tags: Privilege Escalation, Authentication Bypass, WordPress
• Reported by: security@wordfence.com (Wordfence)
• CPE? Not explicitly provided, but EUVD gives affected product: CRM Memberships plugin for WordPress. We'll state product name as "CRM Memberships" (the plugin name). Product name field: "CRM Memberships" (since it's a WordPress plugin, we can say "CRM Memberships" — but it might be better to say "CRM Memberships plugin for WordPress"? The rule: 1-3 words ONLY. So "CRM Memberships" is fine. Or "CRM Memberships WordPress plugin"? That's 4 words. The rule: "product_name: '1-3 words ONLY. The specific product or service name affected.' So I'll go with "CRM Memberships". I'll add context in summary.

Now, synthesize data:

• summary: 2-3 sentences. Start with impact verb and product: "Privilege escalation in CRM Memberships WordPress plugin allows unauthenticated attackers to gain administrative access by resetting any user's password." Summarize: missing authorization on ntzcrm_changepassword AJAX action, requires knowing email, which can be enumerated via ntzcrm_get_users endpoint. EPSS 0.29% (low probability, but percentile 52% is average), no KEV, so not actively exploited widely. No POC mentioned? Not explicitly, but Wordfence might have a proof of concept? It says "Reported by Wordfence" and "Tags: Privilege Escalation, Authentication Bypass", but no explicit "POC available". So I'll assume no public exploit identified, but the vulnerability is described in detail, so someone could craft exploit. Since no KEV, I'll say "no public exploit identified" but given the simplicity, it's likely easy to exploit. However, I'll stick to available data. There's no POC flag, so "no public exploit identified at time of analysis". But Wordfence advisory might contain details. I'll just note that EPSS is low (0.29%) indicating low likelihood of exploitation despite high CVSS. Summary: "Privilege escalation in the CRM Memberships plugin for WordPress allows unauthenticated attackers to reset any user's password and seize account access. Exploitation requires a target's email address, obtainable via a separate unauthenticated user enumeration endpoint. The vulnerability affects all plugin versions up to 2.5 and carries a CVSS score of 9.8."
• technical_context: Explain the underlying technology. CWE-862 Missing Authorization. The plugin exposes AJAX actions ntzcrm_changepassword and ntzcrm_get_users without proper capability checks. WordPress plugins often register AJAX hooks for both authenticated and unauthenticated users; here they likely used wp_ajax_nopriv_* without authorization. The plugin handles password reset via that endpoint, and missing checks allow any request to change a user's password. CPE not provided, but we can mention it's a WordPress plugin, identified by slug "crm-memberships". Include references to source code files.
• risk_assessment: Compare CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with EPSS 0.29% (low probability). Not in KEV, so no known active exploitation. SSVC: exploitation status "none", automatable yes (since network vector, low complexity, no user interaction), technical impact total. So it's a high-priority risk for organizations using that plugin, because easy to exploit if plugin installed and email can be guessed. But EPSS suggests low real-world exploitation attempts. However, given the enumeration endpoint, it's likely to be exploited in targeted attacks. So risk assessment: "The CVSS 9.8 indicates critical severity with network attack vector, low complexity, no privileges or user interaction required. However, EPSS predicts only a 0.29% probability of exploitation in the next 30 days, placing it in the 52nd percentile, suggesting relatively low active exploitation likelihood. No active exploitation has been confirmed via CISA KEV. Given the ease of exploitation and the presence of a companion user enumeration endpoint, this vulnerability poses a serious risk to any unpatched WordPress site using the plugin, especially if email addresses of privileged users can be guessed or collected." No missing/conflicting data.
• affected_products: "CRM Memberships plugin for WordPress versions up to and including 2.5. The plugin is available from the WordPress plugin repository (slug: crm-memberships). Wordfence advisory confirms affected versions ≤2.5." Provide reference link to Wordfence threat intel page.
• remediation: "Update the CRM Memberships plugin to a patched version. The vendor has released a fix in SVN changeset 3464130, but the exact version number is not specified in available references. Administrators should upgrade to a version beyond 2.5 as soon as it becomes available. As a temporary workaround, disable the plugin entirely or use a Web Application Firewall rule to block unauthorized access to the wp-admin/admin-ajax.php endpoint with action parameters ntzcrm_changepassword and ntzcrm_get_users. Note that blocking these endpoints entirely may break plugin functionality." But we need to be careful: the changeset link points to the commit, so there is a fix committed. Wordfence advisory likely has a version patch? I'll check that link. The reference https://www.wordfence.com/threat-intel/vulnerabilities/id/e2837399-c44f-494e-bdc6-f9c6e4e2dc11?source=cve might indicate the fixed version. I can't access it, but from the data, it says affected up to 2.5. So possibly fixed in 2.5.1. I'll say: "The vendor has released a patched version, likely 2.5.1 or higher, via WordPress plugin repository. Immediate update is required." Then suggest workaround. I'll mention exact changeset.
• exploit_scenario: "An attacker sends an unauthenticated AJAX request to wp-admin/admin-ajax.php with action=ntzcrm_get_users to enumerate subscriber emails, then uses a known or guessed Admin email to send another request with action=ntzcrm_changepassword, user_email=target, and new_password, resetting the password and gaining full access to the account." No POC mentioned, but scenario is clear.
• exploitation_conditions: "The attacker must know or be able to guess a valid email address of a target user (which can be obtained via the ntzcrm_get_users endpoint if that endpoint is accessible). No authentication is required. The plugin must be active and vulnerable version ≤2.5 installed. The wp-admin/admin-ajax.php must be reachable (default for WordPress)." So condition: "Requires the targeted user's email address. The companion unauthenticated user enumeration endpoint facilitates this, but if that endpoint is blocked or disabled, attacker must obtain email through other means." So conditions: email address knowledge, plugin enabled, network access to AJAX endpoint. I'll phrase: "Exploitation requires the attacker to have or obtain the target user's email address, which is facilitated by the plugin's own unauthenticated user enumeration endpoint. No special configuration beyond default WordPress deployment is needed."
• attack_chain: "Send request to ntzcrm_get_users endpoint → Enumerate subscriber email addresses → Identify admin user email → Send password reset request to ntzcrm_changepassword with target email and new password → Password changed → Log in as target user → Escalate privileges to administrator." But check phases: Recon (enumerate) → Delivery (send AJAX request) → Exploit (missing auth) → Impact (access). 7 steps: Recon → Delivery → Exploit → Install (maybe not) → C2 → Execute → Impact. Simpler: 5-step: Access → Delivery → Exploit → Execution → Impact. I'll do: "Access WordPress admin-ajax endpoint → Send enumeration request to ntzcrm_get_users → Extract admin email from response → Send password reset request to ntzcrm_changepassword with admin email and new password → Gain administrative access via login." That's 5 steps.
• confidence_notes: "Vulnerability details confirmed by Wordfence advisory and NVD CVE record. Patch existence confirmed by SVN changeset 3464130, but fixed version number not independently verified. No known active exploitation (not in KEV). EPSS score is low but assessment may underestimate threat due to simplicity of exploit." Good.
• prevalence: The CRM Memberships plugin: how popular? It's a WordPress plugin. I can check its install base: I'm not sure, but "CRM Memberships" is not a top plugin. It might have a few thousand active installs. I'd estimate low to medium. Since it's a niche membership plugin, I'll say "low". But I'll see: WordPress plugin directory can have installs; but without that data, I'll go with "low" because it's not a commonly used plugin like WooCommerce, Yoast, etc. So prevalence: low. Basis: "niche WordPress membership plugin with limited install base". If unknown, but I'll infer low from typical membership plugins. I'll output "low", basis: "specialized WordPress plugin with limited deployment footprint".
• prevalence_basis: "niche WordPress membership plugin, not widely distributed"
• assessed_cvss_vector: I'll produce my own CVSS 3.1 vector. The description says unauthenticated, via network, no user interaction, scope unchanged, impacts confidentiality, integrity, availability all high. So AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exactly same as provided. That's appropriate. So vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Unauthenticated network attack with no user interaction, complete compromise of user accounts." I'll check if any nuance: attacker can reset any password, leading to full account takeover, so C/H, I/H, A/H sensible.
• assessed_cvss40_vector: CVSS 4.0 base. We need to map. Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Attack Requirements: None (AT:N), Privileges Required: None (PR:N), User Interaction: None (UI:N). Scope? In CVSS 4.0, we have VC/VI/VA (vulnerable system impact) and SC/SI/SA (subsequent system impact). This is a web application, so vulnerable system is the WordPress instance. Attacker gains account access, leading to high impact on confidentiality, integrity, availability of that system. So VC:H/VI:H/VA:H. No subsequent system impact, so SC:N/SI:N/SA:N. So CVSS 4.0 vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N". That seems correct.

Now, the final output. Ensure all fields are strings. I'll craft each paragraph.

Note: The description says "privilege escalation via password reset" and "unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts". So that's clear. No KEV. EPSS 0.29%. I'll incorporate.

Technical context: CWE-862 Missing Authorization. The plugin likely registers AJAX hooks using WordPress's wp_ajax_ and wp_ajax_nopriv_ actions. The ntzcrm_changepassword action is registered for both authenticated and unauthenticated users but lacks a capability check or nonce verification, allowing anyone to trigger password change. The companion ntzcrm_get_users endpoint similarly lacks authentication,