CVE-2026-24595: 
WordPress vulnerability analysis and mitigation

CVE-2026-24595 is a Missing Authorization vulnerability in the Zoho CRM Lead Magnet WordPress plugin (plugin slug: zoho-crm-forms) that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin through 1.8.1.9, with the scope later expanded from the initially reported 1.8.1.5. It was first published on January 23, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) by Patchstack (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain actions or accessing restricted functionality. This is a broken access control issue where low-privileged authenticated users (e.g., subscribers or contributors) can perform operations that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit once an attacker has any valid WordPress account (Patchstack, NVD).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions affecting the integrity and availability of the plugin's functionality, such as modifying plugin settings or CRM form configurations. The updated CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) indicates limited impact on both integrity and availability, with no direct confidentiality exposure. While the impact is constrained to the plugin's scope, unauthorized modification of CRM lead capture forms could disrupt lead collection workflows or redirect form submissions (NVD).

The vulnerability has a low EPSS score of approximately 0.025%, indicating a low probability of active exploitation in the near term. No public proof-of-concept exploit code, in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) WordPress account on the target site, limiting opportunistic mass exploitation (NVD, Patchstack).

WordPress site administrators should update the Zoho CRM Lead Magnet plugin to a version beyond 1.8.1.9, which is the last confirmed vulnerable release. Until a patched version is available or confirmed, administrators should restrict plugin access to trusted users only and audit existing low-privileged user accounts on the WordPress installation. Monitoring the WordPress plugin repository for an updated release and applying it promptly is the recommended remediation (Patchstack, NVD).