Medium severity · published Jan 14, 2026
CVE-2025-14854
WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses. CVE-2025-62106 is likely a duplicate of this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WP-CRM System – Manage Clients and Projects · nofearinc
through 3.4.5 · source: vendor
Affected product
WS
WP-CRM System – Manage Clients and Projects
nofearinc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14854
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-dashboard-task-list.php?marks=177-190#L177
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.5/includes/wcs-functions.php?marks=942-975#L942
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-functions.php?marks=942-975#L942
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/da607df4-1dbb-4b1e-ace6-b339cf9e8512?source=cve
More from WP-CRM System – Manage Clients and Projects
4.3
CVE-2026-9004
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter