CVE-2025-14854: WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification
The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrmgetemailrecipients and wpcrmsystemajaxtaskchangestatus AJAX functions in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with subscriber level access and above, to enumerate CRM contact email addresses (PII disclosure) and modify CRM task statuses. CVE-2025-62106 is likely a duplicate of this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14854?
The severity of CVE-2025-14854 is considered high due to the potential for unauthorized access to sensitive CRM data.
How do I fix CVE-2025-14854?
To fix CVE-2025-14854, update the WP-CRM System plugin to version 3.4.6 or later which includes necessary authorization checks.
What systems are affected by CVE-2025-14854?
CVE-2025-14854 affects WP-CRM System versions up to and including 3.4.5 running on WordPress.
What kind of data exposure does CVE-2025-14854 cause?
CVE-2025-14854 allows authenticated users with subscriber-level access to view and modify CRM data they should not have access to.
Who can exploit CVE-2025-14854?
Any authenticated user with a subscriber role or higher in WordPress can exploit CVE-2025-14854 due to missing capability checks.