CVE-2025-13313 Details
Description
The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX action. This makes it possible for unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts via the `ntzcrm_changepassword` endpoint, granted they can obtain or enumerate a target user's email address. The plugin also exposes the `ntzcrm_get_users` endpoint without authentication, allowing attackers to enumerate subscriber email addresses, facilitating the exploitation of the password reset vulnerability.
A privilege escalation vulnerability has been identified in the CRM Memberships plugin for WordPress, affecting all versions through 2.5. The issue arises from inadequate authorization and authentication checks on the 'ntzcrm_changepassword' AJAX action. This vulnerability allows unauthenticated attackers to reset passwords for any user, provided they can access or guess the target user's email address. Additionally, the plugin's 'ntzcrm_get_users' endpoint is available without authentication, enabling attackers to collect email addresses of subscribers, which can be used to exploit the password reset feature.
No patch is currently available. Users are advised to uninstall the affected plugin and consider a replacement.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 5, 2025CISA-ADP
Assessed Dec 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NTZApps CRM Memberships | <= 2.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | CVE Modified | [email protected] |
| Dec 5, 2025 | New CVE Received | [email protected] |