Description

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T08:16:43.350Z",
  "pubdate": "2026-09-22T08:16:43.350Z",
  "executiveSummary": "The WP-CRM System – Manage Clients and Projects plugin for WordPress is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting in Sensitive Information Exposure.\nThis vulnerability exists in all versions up to and including 3.4.6, affecting the application's CRM contact management functionality.\nAuthenticated users possessing contributor-level access or higher can exploit this flaw to bypass intended authorization controls.\nBy manipulating the 'contact_id' parameter, an attacker can programmatically enumerate and retrieve the private records of arbitrary CRM contacts.\nThe exposed data includes personally identifiable information (PII) such as full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical residential or business addresses.\nThe primary risk implication involves mass data exfiltration of customer databases, potentially violating data privacy regulations and resulting in significant reputational and operational damage to the affected organization.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the plugin’s data retrieval mechanism for CRM contact records. The application fails to validate whether the authenticated requester has the requisite privileges or ownership rights to access the specific resource requested via the 'contact_id' parameter.\nThe exploitation flow begins with an authenticated user (contributor level or higher) identifying the endpoint responsible for fetching CRM contact data. Because the application processes the 'contact_id' parameter without verifying if the requested record belongs to a set accessible by the current user, it creates an IDOR condition.\nAn attacker can automate the exploitation process by executing a loop that increments the 'contact_id' integer. For each iteration, the attacker sends a crafted request to the vulnerable endpoint. Given the lack of server-side access control, the backend database queries the requested CRM record and returns the associated sensitive metadata to the attacker's session.\nThe exposed record set encompasses extensive PII fields defined within the plugin's schema. Since the plugin processes these requests in the context of the user's session, the server interprets these queries as legitimate, facilitating the systematic scraping of the entire CRM contact database.\nThe vulnerable component resides within the plugin's backend logic where CRM contact information is processed and displayed. Versions up to 3.4.6 are affected as they lack the necessary conditional checks to enforce object-level permissions. This exposure is accessible over the network for any user who successfully authenticates to the WordPress instance with at least contributor-level privileges.\nPost-exploitation impact includes the full compromise of CRM contact data, which can be utilized for phishing campaigns, identity theft, or unauthorized data profiling. The absence of server-side object-level access control enables an attacker to circumvent the standard security model of the WordPress application."
}