The WP‑CRM System plugin for WordPress contains a missing authorization check on two AJAX endpoints that control contact email visibility and task status changes. When present, an authenticated user with subscriber or higher privileges can request the internal function that lists all CRM contact email addresses, thereby revealing personally identifiable information. The same lack of capability checks also allows a legitimate subscriber account to change the status of any CRM task. These actions do not grant code execution or administrative control, but they do compromise the confidentiality of sensitive contact data and the integrity of task management, both of which are critical to project tracking and client privacy.

The vulnerability affects the WP‑CRM System plugin developed by nofearinc, with all releases up to and including 3.4.5 susceptible. Versions 3.4.6 and later contain the necessary capability checks that prevent these unauthorized actions.

The CVSS score of 5.4 indicates a medium severity, while the EPSS score of less than 1% suggests the exploitation probability is low at present. The flaw is not documented in CISA’s KEV catalog. An attacker must be authenticated – typically as a subscriber or higher user – to exploit the flaw, which can be performed from any remote location where the WordPress site is accessible. The lack of protection allows enumeration of sensitive data and alteration of task records, thereby exposing private email addresses and potentially allowing malicious re‑ordering or blocking of tasks. Overall, the risk is moderate but non‑negligible for deployments that rely on strict role separation or where subscriber accounts hold access to sensitive information.