CVE-2025-12696 — HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset

CVE-2025-12696

HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset PUBLISHED

Description (CNA)

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them

Affected (CNA)

Vendor / product	Versions
Unknown / HelloLeads CRM Form Shortcode	affected 0 through 1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e552dfc8-c6e1-4605-bc36-30dc4066eaea/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.