CVE-2025-47690: WP Leads Builder Privilege Escalation

CVE-2025-47690 Overview

CVE-2025-47690 is a missing authorization vulnerability in the Smackcoders Lead Form Data Collection to CRM WordPress plugin (wp-leads-builder-any-crm). The flaw affects all versions through 3.1 and allows authenticated users with low privileges to update arbitrary WordPress options. Attackers can leverage arbitrary option updates to achieve privilege escalation to administrator. The vulnerability maps to CWE-862: Missing Authorization and is tracked in the Patchstack Vulnerability Report.

Critical Impact
Authenticated low-privilege users can escalate to administrator by writing arbitrary WordPress options, leading to full site takeover.

Affected Products

Smackcoders Lead Form Data Collection to CRM plugin (wp-leads-builder-any-crm)
All versions through 3.1
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-05-23 - CVE-2025-47690 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47690

Vulnerability Analysis

The Lead Form Data Collection to CRM plugin exposes plugin actions that update WordPress options without enforcing proper capability checks. Because authorization is missing, any authenticated user — including subscriber-level accounts — can invoke the action and modify sensitive options stored in the wp_options table. WordPress treats options such as default_role, users_can_register, siteurl, and home as configuration primitives. Modifying them changes the security posture of the entire site.

Root Cause

The root cause is the absence of a capability check (for example current_user_can('manage_options')) and missing nonce verification on the plugin handler that calls update_option(). The handler accepts attacker-controlled option names and values directly from the request. The vulnerability is classified under CWE-862: Missing Authorization.

Attack Vector

An authenticated attacker with low privileges sends a crafted request to the vulnerable plugin endpoint over the network. The request specifies an option name and value of the attacker's choice. By setting default_role to administrator and enabling users_can_register, the attacker registers a new account that is automatically granted administrator capabilities. Alternative paths include rewriting siteurl to load malicious JavaScript or injecting administrative users through serialized option data. No user interaction is required beyond the attacker's own session.

No public proof-of-concept exploit is currently listed in Exploit-DB. The EPSS probability is 0.254%.

Detection Methods for CVE-2025-47690

Indicators of Compromise

Unexpected modifications to wp_options entries such as default_role, users_can_register, siteurl, or home
New administrator accounts created shortly after low-privilege user activity
HTTP POST requests to admin-ajax.php or plugin endpoints referencing wp-leads-builder-any-crm from non-admin sessions
Outbound requests to unknown CRM endpoints initiated by the plugin

Detection Strategies

Monitor the wp_options table for writes to security-relevant keys and alert on changes outside maintenance windows
Inspect WordPress audit logs for update_option calls originating from subscriber or contributor accounts
Correlate plugin action invocations with the requester's role to flag low-privilege users hitting privileged handlers
Hash and baseline the plugin files; alert when version 3.1 or earlier remains installed

Monitoring Recommendations

Enable a WordPress activity logging plugin or forward PHP and web server logs to a central SIEM
Alert on new user registrations with administrator role assignment
Track HTTP requests that include the plugin's action parameter and originate from authenticated low-privilege sessions

How to Mitigate CVE-2025-47690

Immediate Actions Required

Update the Lead Form Data Collection to CRM plugin to a version newer than 3.1 once the vendor publishes a fix
If no patch is available, deactivate and remove the plugin from all WordPress installations
Audit wp_users and wp_usermeta for unauthorized administrator accounts and remove them
Reset passwords for all administrator accounts and rotate WordPress salts in wp-config.php

Patch Information

At the time of publication, no fixed version is identified in the available references. Review the Patchstack Vulnerability Report for the latest vendor patch status and apply updates as soon as they are released.

Workarounds

Restrict the plugin's AJAX action endpoints using a Web Application Firewall (WAF) rule that blocks requests from non-administrator sessions
Disable user registration by setting users_can_register to 0 and confirm default_role is subscriber
Limit access to /wp-admin/admin-ajax.php from untrusted IP ranges where feasible

bash

# Verify critical WordPress options via WP-CLI
wp option get default_role
wp option get users_can_register
wp option get siteurl
wp option get home

# Force-disable open registration and reset default role
wp option update users_can_register 0
wp option update default_role subscriber

# Remove the vulnerable plugin until a patched version is released
wp plugin deactivate wp-leads-builder-any-crm
wp plugin delete wp-leads-builder-any-crm