HelloLeads CRM Form Shortcode WordPress Plugin Unauthenticated Settings Reset Vulnerability

A vulnerability exists in the HelloLeads CRM Form Shortcode WordPress plugin, versions through 1.0, due to the absence of authorization and Cross-Site Request Forgery (CSRF) protections when resetting plugin settings. This flaw allows unauthenticated users to reset the plugin's configuration.

Impact

Exploitation of this vulnerability allows for unauthorized users to reset the plugin's settings, potentially disrupting user configurations or workflows.

Reproduction

To reproduce this vulnerability, first configure the HelloLeads CRM Form Shortcode plugin with an API key. Then, send a POST request to 'wp-admin/admin-ajax.php' with the action 'hls_crmf_reset_crm_config' and a token value of 'reset'. This request will reset the API key, demonstrating the vulnerability.