CVE-2026-9004
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The WP-CRM System plugin for WordPress in versions up to and including 3.4.6 is vulnerable to Sensitive Information Exposure via the 'contact_id' parameter. An authenticated attacker with contributor-level access or higher can enumerate this parameter to extract CRM contact data such as full names, email addresses, phone, mobile and fax numbers, and physical addresses.
Risk Assessment
An attacker can mass-harvest personal data of customers stored in the CRM, leading to privacy breaches and potential legal consequences (GDPR).
Recommendation
Update the WP-CRM System plugin to a version newer than 3.4.6 as soon as it becomes available, and in the meantime restrict access to contributor-level roles.
Other vulnerabilities in WP-CRM System
Original NVD description (English source)
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS