The Integrate Dynamics 365 CRM plugin for WordPress contains missing capability checks and nonce verification on initialization hooks, allowing unauthenticated attackers to deactivate the plugin, alter OAuth settings, or trigger test connections that expose sensitive data. The vulnerability permits an attacker to perform unauthorized administrative actions and could expose confidential integration details. The weakness corresponds to the absence of proper authentication, as identified by CWE-306.

The flaw affects all WordPress installations running the Integrate Dynamics 365 CRM plugin version 1.0.9 or earlier. The product is developed by the vendor cyberlord92. Site operators using any of these affected plugin releases are at risk.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely network‑based, requiring the attacker to craft HTTP requests to the plugin's unprotected init endpoints, which can be performed without credentials or access to the WordPress administration interface. Given the lack of authentication checks, attackers do not need user accounts to exploit the issue, but do need knowledge of endpoint URLs and parameters.