The HelloLeads CRM Form Shortcode WordPress plugin up to version 1.0 lacks any authorization or CSRF protection when resetting its settings. An attacker can send a request to the reset endpoint without authenticating and force the plugin to revert to its default configuration, potentially disrupting application behavior, exposing sensitive configuration data, or weakening defenses for future attacks. The flaw primarily affects configuration integrity and availability of the WordPress site hosting the plugin.

The vulnerability affects the HelloLeads CRM Form Shortcode plugin for WordPress, versions up to 1.0. All WordPress installations that include this plugin prior to an updated version are at risk; no other vendors or versions are currently known to be impacted.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of less than 1% points to a low probability of public exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely target the reset URL directly, as no CSRF token or authentication check exists. Because the flaw requires only the presence of the request URL, any user who can reach the site could trigger a reset, underscoring the importance of mitigations even in low‑exploitation scenarios.