PT-2025-49191

CVE-2025-13312

·

Published

2025-12-04

·

Updated

2026-09-25

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions CRM Memberships plugin for WordPress versions prior to 2.6
Description The CRM Memberships plugin for WordPress is susceptible to unauthorized membership tag creation. This is due to a missing capability check within the ntzcrm add new tag() function. This allows unauthenticated attackers to create arbitrary membership tags and modify CRM configuration intended for administrators only.
Recommendations Update the CRM Memberships plugin to version 2.6 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2025-13312
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com