CVE-2025-13092

MediumCVSS 5.3

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The Devs CRM plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API endpoint in all versions up to and including 1.1.8. This allows unauthenticated attackers to retrieve private user data, including password hashes.

Risk Assessment

An attacker can access sensitive user data, potentially leading to privacy breaches and account takeover.

Recommendation

Update the plugin to a patched version immediately. Also restrict API access for unauthorized users.

Other vulnerabilities in Devs CRM

CVE-2025-13093Medium
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to and including 1.1.8. This allows unauthenticated attackers to update leads tags.

Original NVD description (English source)

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to retrieve private user data, including password hashes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS