CVE-2025-14854

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14854", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-17T20:47:41.920Z", "datePublished": "2026-01-14T05:28:12.974Z", "dateUpdated": "2026-04-08T17:27:19.435Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:19.435Z"}, "affected": [{"vendor": "nofearinc", "product": "WP-CRM System \u2013 Manage Clients and Projects", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.4.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses. \tCVE-2025-62106 is likely a duplicate of this issue."}], "title": "WP-CRM System \u2013 Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da607df4-1dbb-4b1e-ace6-b339cf9e8512?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-functions.php?marks=942-975#L942"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-dashboard-task-list.php?marks=177-190#L177"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-functions.php?marks=942-975#L942"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Teerachai Somprasong"}], "timeline": [{"time": "2025-12-16T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-13T16:44:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T17:26:11.009304Z", "id": "CVE-2025-14854", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T17:26:26.971Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14854", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T17:26:11.009304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T17:26:22.580Z"}}], "cna": {"title": "WP-CRM System \u2013 Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification", "credits": [{"lang": "en", "type": "finder", "value": "Teerachai Somprasong"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "nofearinc", "product": "WP-CRM System \u2013 Manage Clients and Projects", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.4.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-16T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2026-01-13T16:44:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da607df4-1dbb-4b1e-ace6-b339cf9e8512?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-functions.php?marks=942-975#L942"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-dashboard-task-list.php?marks=177-190#L177"}], "descriptions": [{"lang": "en", "value": "The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-14T05:28:12.974Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14854", "state": "PUBLISHED", "dateUpdated": "2026-01-15T17:26:26.971Z", "dateReserved": "2025-12-17T20:47:41.920Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-14T05:28:12.974Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP-CRM System \u2013 Manage Clients and Projects", "vendor": "nofearinc", "versions": [{"lessThanOrEqual": "3.4.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses. \tCVE-2025-62106 is likely a duplicate of this issue."}, {"lang": "es", "value": "El plugin WP-CRM System para WordPress es vulnerable a acceso no autorizado debido a la falta de comprobaciones de capacidad en las funciones AJAX wpcrm_get_email_recipients y wpcrm_system_ajax_task_change_status en todas las versiones hasta la 3.4.5, inclusive. Esto permite a atacantes autenticados, con acceso de nivel de suscriptor y superior, enumerar direcciones de correo electr\u00f3nico de contactos de CRM (divulgaci\u00f3n de PII) y modificar estados de tareas de CRM."}], "id": "CVE-2025-14854", "lastModified": "2026-06-17T08:36:39.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14854", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T17:26:11.009304Z", "version": "2.0.3"}}]}, "published": "2026-01-14T06:15:53.357", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-dashboard-task-list.php?marks=177-190#L177"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-functions.php?marks=942-975#L942"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-functions.php?marks=942-975#L942"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da607df4-1dbb-4b1e-ace6-b339cf9e8512?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:06:54.721449+00:00", "value": {"mitigation_remediation": ["Upgrade the WP\u2011CRM System plugin to version 3.4.6 or later.", "Revoke or restrict the capabilities that allow subscribers to invoke the wpcrm_get_email_recipients or wpcrm_system_ajax_task_change_status functions using the WordPress role editor.", "If an immediate update is not possible, temporarily block the AJAX endpoints by denying access to the wpcrm-site-ajax.php script or by configuring a firewall rule that limits the affected URLs to administrators only."], "summary": {"action": "Patch", "impact": "Confidentiality and Integrity Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WP\u2011CRM System plugin developed by nofearinc, with all releases up to and including 3.4.5 susceptible. Versions 3.4.6 and later contain the necessary capability checks that prevent these unauthorized actions.", "description_and_impact": "The WP\u2011CRM System plugin for WordPress contains a missing authorization check on two AJAX endpoints that control contact email visibility and task status changes. When present, an authenticated user with subscriber or higher privileges can request the internal function that lists all CRM contact email addresses, thereby revealing personally identifiable information. The same lack of capability checks also allows a legitimate subscriber account to change the status of any CRM task. These actions do not grant code execution or administrative control, but they do compromise the confidentiality of sensitive contact data and the integrity of task management, both of which are critical to project tracking and client privacy.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a medium severity, while the EPSS score of less than 1% suggests the exploitation probability is low at present. The flaw is not documented in CISA\u2019s KEV catalog. An attacker must be authenticated \u2013 typically as a subscriber or higher user \u2013 to exploit the flaw, which can be performed from any remote location where the WordPress site is accessible. The lack of protection allows enumeration of sensitive data and alteration of task records, thereby exposing private email addresses and potentially allowing malicious re\u2011ordering or blocking of tasks. Overall, the risk is moderate but non\u2011negligible for deployments that rely on strict role separation or where subscriber accounts hold access to sensitive information."}}}}, "created": "2026-01-14T10:48:51.515193+00:00", "updated": "2026-04-20T21:15:20.626570+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wp-crm", "wp-crm$PRODUCT$wp-crm_system"]}