CVE-2025-62740
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.
Analysis
Missing authorization controls in Mario Peshev WP-CRM System plugin up to version 3.4.6 allow unauthenticated remote attackers to modify data through incorrectly configured access control security levels. The CVSS 5.3 score reflects low integrity impact with no confidentiality or availability consequences, but the vulnerability exposes the plugin to unauthorized data manipulation attacks without authentication.
Technical Context
The vulnerability stems from CWE-862 (Missing Authorization), a failure to implement proper access control checks before permitting sensitive operations. In the WordPress plugin ecosystem, this typically manifests when plugin functions that modify database records (posts, users, custom data) lack proper capability checks or nonce verification. The WP-CRM System plugin appears to have inadequately implemented WordPress security standards (check_admin_referer, current_user_can) when handling access to CRM-related operations, allowing the access control security levels to be bypassed. The vulnerability affects the Mario Peshev WP-CRM System plugin identified via CPE references on the Patchstack vulnerability database.
Affected Products
Mario Peshev WP-CRM System WordPress plugin versions from inception through 3.4.6 are affected. The vulnerability is documented in the Patchstack vulnerability database with references to version 3.4.5 analysis, indicating that at minimum versions 3.4.5 and 3.4.6 are confirmed vulnerable. Site administrators running any version of the WP-CRM System plugin should verify their installed version and take remediation steps. The plugin is distributed through the WordPress.org plugin repository and third-party WordPress hosting environments.
Remediation
Update the WP-CRM System plugin to the patched version (specific fixed version number not stated in available advisory data; check Patchstack and WordPress.org plugin repository for the latest release). Immediately access the WordPress admin dashboard, navigate to Plugins, search for 'WP-CRM System,' and click 'Update Now' if available. If no patched version is yet released, disable the plugin temporarily until a fix is available; alternatively, contact the plugin author (Mario Peshev) or monitor the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/wp-crm-system/vulnerability/wordpress-wp-crm-system-plugin-3-4-5-broken-access-control-vulnerability for patch release notifications. Ensure WordPress core and all other plugins are kept updated to reduce attack surface.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today