CVE-2025-5692: Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LBadminajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5692?
CVE-2025-5692 has a high severity due to its potential for unauthorized modification of data leading to privilege escalation.
How do I fix CVE-2025-5692?
To fix CVE-2025-5692, update the Lead Form Data Collection to CRM plugin to version 3.2 or later, which includes necessary capability checks.
Which versions of the software are affected by CVE-2025-5692?
All versions of the Lead Form Data Collection to CRM plugin for WordPress up to and including version 3.1 are affected by CVE-2025-5692.
What types of attacks can CVE-2025-5692 enable?
CVE-2025-5692 can enable unauthorized users to modify data and escalate their privileges within the WordPress installation.
Who should be concerned about CVE-2025-5692?
Website administrators using the Lead Form Data Collection to CRM plugin for WordPress should be particularly concerned about CVE-2025-5692.