The Lead Form Data Collection to CRM plugin has a missing capability check in its AJAX handling file, which allows users with Subscriber-level access and above to invoke privileged actions such as updating plugin settings. This flaw falls under the missing authorization category and can be used by an attacker who is already authenticated on the site to change configuration data. The vulnerability does not grant direct code execution but elevates the attacker’s influence within the site’s settings.

This issue affects the Lead Form Data Collection to CRM plugin from SmackCoders, all releases up to and including version 3.1 on WordPress installations. Systems running any of these versions with a web interface and a valid subscriber or higher user account are vulnerable.

The CVSS score of 6.3 indicates a medium severity. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attack vector is most likely web-based, requiring an attacker to be authenticated with at least a Subscriber role and to send crafted AJAX requests to the LB_admin_ajax.php endpoint. No additional local privileges are needed beyond the normal Subscriber permissions.