The CRM Memberships plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the ntzcrm_changepassword AJAX action, allowing unauthenticated attackers to reset passwords of arbitrary users if they know or can enumerate the users' email addresses. The plugin also exposes the ntzcrm_get_users endpoint without authentication, which permits attackers to enumerate subscriber emails, aiding in targeted exploitation. This results in privilege escalation and unauthorized account access. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to reset passwords for any user account, leading to full account takeover. The exposure of subscriber email addresses facilitates targeted attacks. The vulnerability compromises confidentiality, integrity, and availability of user accounts within the affected WordPress plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected AJAX endpoints if possible, and monitor for suspicious activity related to password resets. Avoid using the affected plugin version in production environments.