The vulnerability lies in the AMO.CRM WordPress integration, where the settings_page function omits proper nonce checks. This flaw allows an attacker, even without authentication, to craft a forged request that an unsuspecting site administrator might click. By doing so the attacker can change the plugin’s critical API connection details, including the API URL and login credentials. Such a compromise could lead to unauthorized access to the AMO.CRM account, data exfiltration, or further lateral movement within the WordPress installation.

The issue affects the AMO.CRM plugin for WordPress, in all audited releases up to and including version 1.0.1. Any site running these versions is vulnerable.

The CVSS score of 4.3 classifies this as a moderate severity flaw. The EPSS score of less than 1% indicates that exploitation is considered unlikely at the current time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a user‑friendly lure, such as a malicious link or embedded iframe, delivered to a site administrator. Once the admin clicks the link, the forged request is sent from the admin’s browser, bypassing server‑side checks and allowing the attacker to alter API credentials.