Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-2405: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-c...
CVE-2023-2405 · published 3 years ago
Summary
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings ...
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| vcita | crm_and_lead_management_by_vcita |
<= 2.6.2 cpe:2.3:a:vcita:crm_and_lead_management_by_vcita:*:*:*:*:*:wordpress:*:* |
Original advisory text
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-c...
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://plugins.trac.wordpress.org/changeset/3256449/crm-customer-relationship-m...
- https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita Exploit Third Party Advisory
- https://plugins.trac.wordpress.org/browser/crm-customer-relationship-management-... Exploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0f75c6bf-1b93-49d5-b5f... Broken Link
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published3 Jun 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-2405 · NVD
Track software like this
Free during beta