CVE-2025-9628

Name of the Vulnerable Software and Affected Versions AMO.CRM plugin for WordPress versions prior to 1.0.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the settings page() function. This allows unauthenticated attackers to modify critical API connection settings, such as the AMO.CRM API URL, login credentials, and API hash key, by tricking a site administrator into clicking a malicious link.

Recommendations Update the plugin to a version later than 1.0.1. As a temporary mitigation, restrict access to the settings page() function to prevent unauthorized modifications.