Wp Crm System Manage Clients And Projects
Monthly
Authenticated users with contributor-level access or higher on WordPress sites running the WP-CRM System plugin (all versions up to and including 3.4.6) can enumerate the contact_id parameter to read PII belonging to arbitrary CRM contact records, including full names, email addresses, phone, mobile and fax numbers, and physical addresses. The flaw is a CWE-200 sensitive information exposure reachable over the network with low privileges (CVSS 4.3, AV:N/AC:L/PR:L/UI:N) and requires only a valid contributor account plus a populated CRM address book; no user interaction or special configuration is needed beyond the plugin being installed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no KEV listing), so the practical risk is a low-severity, read-only privacy disclosure whose real-world exposure scales with how freely contributor accounts are granted on the site.
Authenticated users with contributor-level access or higher on WordPress sites running the WP-CRM System plugin (all versions up to and including 3.4.6) can enumerate the contact_id parameter to read PII belonging to arbitrary CRM contact records, including full names, email addresses, phone, mobile and fax numbers, and physical addresses. The flaw is a CWE-200 sensitive information exposure reachable over the network with low privileges (CVSS 4.3, AV:N/AC:L/PR:L/UI:N) and requires only a valid contributor account plus a populated CRM address book; no user interaction or special configuration is needed beyond the plugin being installed. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no KEV listing), so the practical risk is a low-severity, read-only privacy disclosure whose real-world exposure scales with how freely contributor accounts are granted on the site.