PT-2025-40614 · WordPress · Integrate Dynamics 365 Crm Plugin For Wordpress

Jonas Benjamin Friedli · Published 2025-10-04 · Updated 2025-10-04 · CVE-2025-10746

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Integrate Dynamics 365 CRM plugin for WordPress versions through 1.0.9

Description The Integrate Dynamics 365 CRM plugin for WordPress is susceptible to unauthorized access due to missing capability checks and nonce verification on functions hooked to 'init'. This allows unauthenticated attackers to deactivate the plugin, modify OAuth configuration, and initiate test connections that reveal sensitive data through direct requests to vulnerable API endpoints by crafting malicious requests with specific parameters.

Recommendations Update Integrate Dynamics 365 CRM plugin for WordPress to a version later than 1.0.9.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-10746

Affected Products

Integrate Dynamics 365 Crm Plugin For Wordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10746 · Security Note
• https://twitter.com/VulmonFeeds/status/1974413159319429220 · Twitter Post
• https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/Observer/adminObserver.php#L26 · Note
• https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/trunk/Observer/class-adminobserver.php?rev=3370266#L71 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c?source=cve · Note
• https://t.me/CVEtracker/34074 · Telegram Post
• https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/integrate-dynamics-365-crm.php#L48 · Note