WP-CRM System CVE-2026-9004

Requires an authenticated WordPress account with contributor-level privileges or above on a site running WP-CRM System ≤3.4.6 (PR:L). No user interaction or non-default configuration is needed beyond having the plugin installed and populated with CRM contact records. Exploitation is limited by the authentication requirement - sites that do not permit self-registration or contributor accounts for untrusted users substantially reduce exposure. The attack reads data only (no write/modify), so impact is confined to disclosure of contact PII.

This is a genuine but low-severity information-disclosure issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, but requiring low-privilege authentication (contributor-level) and yielding only confidentiality impact rated Low. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the input - exploitation status is therefore 'no public exploit identified at time of analysis'. No SSVC decision data was provided. The C:L rating is defensible because although the exposed data is real PII (names, emails, phone/mobile/fax numbers, physical addresses of CRM contacts), it is limited to one plugin's contact records rather than system-wide credentials or secrets. The one caveat worth flagging: the CWE is labeled CWE-200 (generic info exposure), but the underlying mechanism - enumerating a numeric 'contact_id' to read arbitrary records - is functionally an IDOR/broken-object-level-authorization flaw (closer to CWE-639); this does not change the risk but is worth noting for classification accuracy. Overall: low real-world priority given the authentication requirement, niche plugin footprint, and absence of exploitation signals, though data-privacy/GDPR exposure of harvested PII is the main concrete harm.

An attacker who has obtained (or registered for) a contributor-level or higher account on a WordPress site running WP-CRM System issues requests that iterate the 'contact_id' parameter against the address-book endpoint, harvesting full names, emails, phone/mobile/fax numbers, and physical addresses for every CRM contact. No public proof-of-concept is referenced, but the attack is trivial to automate given low complexity (AC:L) and requires only a low-privilege authenticated session.