CVE-2025-13093

MediumCVSS 5.3

Published: 13/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to and including 1.1.8. This allows unauthenticated attackers to update leads tags.

Risk Assessment

Unauthorized modification of lead tags could lead to CRM data manipulation, affecting sales processes and data integrity.

Recommendation

Update the Devs CRM plugin to the latest patched version. Also add proper API access controls.

Other vulnerabilities in Devs CRM

CVE-2025-13092Medium
The Devs CRM plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API endpoint in all versions up to and including 1.1.8. This allows unauthenticated attackers to retrieve private user data, including password hashes.

Original NVD description (English source)

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS