CVE-2025-10746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10746", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T19:39:41.942Z", "datePublished": "2025-10-04T02:24:36.757Z", "dateUpdated": "2026-04-08T17:17:42.526Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:42.526Z"}, "affected": [{"vendor": "cyberlord92", "product": "Integrate Dynamics 365 CRM", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters."}], "title": "Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/Observer/adminObserver.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/integrate-dynamics-365-crm.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/trunk/Observer/class-adminobserver.php?rev=3370266#L71"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-03T14:18:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T14:14:34.144280Z", "id": "CVE-2025-10746", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T14:16:41.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T14:14:34.144280Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T14:14:38.531Z"}}], "cna": {"title": "Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "cyberlord92", "product": "Integrate Dynamics 365 CRM", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-03T14:18:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/Observer/adminObserver.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/integrate-dynamics-365-crm.php#L48"}, {"url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/trunk/Observer/class-adminobserver.php?rev=3370266#L71"}], "descriptions": [{"lang": "en", "value": "The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-04T02:24:36.757Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10746", "state": "PUBLISHED", "dateUpdated": "2025-10-06T14:16:41.038Z", "dateReserved": "2025-09-19T19:39:41.942Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-04T02:24:36.757Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Integrate Dynamics 365 CRM", "vendor": "cyberlord92", "versions": [{"lessThanOrEqual": "1.0.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters."}, {"lang": "es", "value": "El plugin Integrate Dynamics 365 CRM para WordPress es vulnerable a acceso no autorizado en todas las versiones hasta la 1.0.9, inclusive. Esto se debe a la falta de comprobaciones de capacidad y verificaci\u00f3n de nonce en funciones enganchadas a 'init'. Esto hace posible que atacantes no autenticados desactiven el plugin, manipulen la configuraci\u00f3n de OAuth y activen conexiones de prueba que exponen datos sensibles a trav\u00e9s de una solicitud directa a endpoints vulnerables, siempre que puedan elaborar solicitudes maliciosas con par\u00e1metros espec\u00edficos."}], "id": "CVE-2025-10746", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10746", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T14:14:34.144280Z", "version": "2.0.3"}}]}, "published": "2025-10-04T03:15:35.860", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/Observer/adminObserver.php#L26"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/tags/1.0.9/integrate-dynamics-365-crm.php#L48"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/integrate-dynamics-365-crm/trunk/Observer/class-adminobserver.php?rev=3370266#L71"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:30:42.980464+00:00", "value": {"mitigation_remediation": ["Update the Integrate Dynamics 365 CRM plugin to a version newer than 1.0.9 that includes the missing authorization checks.", "If an update is unavailable, disable or uninstall the plugin until the fix is released to prevent unauthenticated access to the plugin's endpoints.", "Add a web\u2011server rule (e.g., in .htaccess or Nginx config) that restricts access to the plugin\u2019s admin URLs to authenticated users only, or blocks direct requests to the affected init endpoints."], "summary": {"action": "Upgrade Plugin", "impact": "Unauthorized Access to Plugin Configuration"}, "threat_synthesis": {"affected_systems": "The flaw affects all WordPress installations running the Integrate Dynamics 365 CRM plugin version 1.0.9 or earlier. The product is developed by the vendor cyberlord92. Site operators using any of these affected plugin releases are at risk.", "description_and_impact": "The Integrate Dynamics 365 CRM plugin for WordPress contains missing capability checks and nonce verification on initialization hooks, allowing unauthenticated attackers to deactivate the plugin, alter OAuth settings, or trigger test connections that expose sensitive data. The vulnerability permits an attacker to perform unauthorized administrative actions and could expose confidential integration details. The weakness corresponds to the absence of proper authentication, as identified by CWE-306.", "risk_and_exploitability": "The CVSS score is 6.5, indicating a moderate severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is likely network\u2011based, requiring the attacker to craft HTTP requests to the plugin's unprotected init endpoints, which can be performed without credentials or access to the WordPress administration interface. Given the lack of authentication checks, attackers do not need user accounts to exploit the issue, but do need knowledge of endpoint URLs and parameters."}}}}, "created": "2025-10-06T14:42:02.414000+00:00", "updated": "2026-04-21T02:45:25.932021+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}