The CRM Memberships plugin for WordPress allows an attacker who can reach the web interface to reset any user’s password without authentication. This is caused by missing authorization checks on the ntzcrm_changepassword AJAX endpoint, permitting unauthenticated users to exploit the password reset functionality. Once the password is overridden, the attacker can assume the identity of the targeted account, potentially accessing sensitive data or performing actions on behalf of the legitimate user. The vulnerability leads directly to full account compromise for any user whose email address can be discovered, satisfying the conditions for effective exploitation.

All releases of dripadmin:CRM Memberships plugin up to and including version 2.6 are vulnerable. The issue is present in every build of the plugin released prior to the 2.7 bug‑fix, regardless of additional configuration or site content.

The CVSS score of 9.8 ranks this flaw as critical, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Likely exploitation would occur remotely over the internet by sending crafted AJAX requests to the ntzcrm_changepassword endpoint, following enumeration of a target email via the unprotected ntzcrm_get_users endpoint. The lack of an attacker‑controlled user context means that no privileged user role is required to trigger the vulnerability.