A critical privilege escalation vulnerability in the Lead Form Data Collection to CRM plugin for WordPress allows an authenticated attacker to gain elevated permissions, potentially leading to a full site compromise.

The plugin is vulnerable due to a missing capability check on the doFieldAjaxAction() function. This allows any authenticated attacker, including those with low-level permissions, to send a crafted request to modify data and escalate their privileges on the affected WordPress site.

A successful exploit of this vulnerability could allow an attacker to gain administrative control over the website. This can lead to the theft of sensitive lead data, website defacement, installation of malware, or using the compromised site to attack other systems. With a CVSS score of 8.8 (High), this vulnerability poses a significant and direct threat to the confidentiality, integrity, and availability of the affected WordPress installation.

Immediate Action: Administrators must immediately update the Lead Form Data Collection to CRM plugin to the latest patched version. If the plugin is no longer required, it should be deactivated and removed.

Proactive Monitoring: Review web server and WordPress security logs for suspicious POST requests to admin-ajax.php that reference the doFieldAjaxAction action, which could indicate attempted exploitation.

Compensating Controls: A properly configured Web Application Firewall (WAF) with rules to block malicious requests targeting this specific plugin vulnerability may serve as a virtual patch if immediate updates are not feasible.

Public Exploit Available: false

Given the High severity rating and the risk of complete site compromise, immediate patching is critical. The vulnerability allows an authenticated user to become an administrator, bypassing all existing security controls. All WordPress administrators using this plugin should prioritize applying the vendor-supplied update to prevent unauthorized access and privilege escalation.