The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress contains a missing capability check on the /wp-json/devs-crm/v1/attendances REST API endpoint. As a result, unauthenticated users can retrieve private user data, including password hashes. This leads to an Information Disclosure vulnerability with a medium severity rating (CVSS 5.3).

WordPress sites that have installed the Devs CRM plugin version 1.1.8 or earlier, provided by vendor ajitdas, are susceptible to this flaw. The vulnerability is confined to the plugin’s REST interface and does not directly affect the core WordPress installation.

This vulnerability can be exploited remotely via HTTP by making unauthenticated requests to the public REST API endpoint. The EPSS score is below 1 % and the issue is not in CISA’s KEV catalog, indicating low current exploitation probability. However, because no credentials are needed and the endpoint returns sensitive data, the impact is significant. The CVSS score of 5.3 places it in the medium range, and the absence of authentication checks means attackers could potentially harvest password hashes under insecure configurations.