CVE-2025-62740

MediumCVSS 5.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The WP-CRM System contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.4.6.

Risk Assessment

An attacker may gain unauthorized access to CRM data, potentially leading to leakage of confidential information or manipulation of customer data.

Recommendation

Update the WP-CRM System to the latest version that includes the security fix.

Other vulnerabilities in WP-CRM System

CVE-2026-9004Medium
The WP-CRM System plugin for WordPress in versions up to and including 3.4.6 is vulnerable to Sensitive Information Exposure via the 'contact_id' parameter. An authenticated attacker with contributor-level access or higher can enumerate this parameter to extract CRM contact data such as full names, email addresses, phone, mobile and fax numbers, and physical addresses.

Original NVD description (English source)

Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS