PT-2026-2818 · Nofearinc · Wp-Crm System – Manage Clients/Projects

Teerachai Somprasong · Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-14854

Mitre

CVSS v3.1

5.4

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm get email recipients and wpcrm system ajax task change status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14854

Affected Products

Wp-Crm System – Manage Clients/Projects

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-14854 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-functions.php?marks=942-975#L942 · Note
• https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-dashboard-task-list.php?marks=177-190#L177 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/da607df4-1dbb-4b1e-ace6-b339cf9e8512?source=cve · Note