The flaw in CodeCanyon TimeCamp Integration for CRM allows an attacker to manipulate the contact_id argument of the /clients/save_contact endpoint, leading to an authorization bypass as defined by CWE‑285 and a privilege escalation scenario (CWE‑639). The vulnerability can be triggered remotely, and authenticated or unauthenticated users could exploit it to modify or retrieve contact information they should not have access to. The CVSS score of 5.3 indicates a moderate overall risk due to the lack of a requirement for local privileges but a known remote attack vector.

The issue affects the TimeCamp Integration for CRM plugin distributed via CodeCanyon. Versions up to and including 2.8 are vulnerable; any installation of the plugin before the definition of the fix in later releases is potentially impacted.

Because the vulnerability is exploitable over the network and an exploit has been published publicly, the likelihood of attack is non‑negligible even though the EPSS metric is not available. The lack of inclusion in CISA KEV suggests it has not yet been confirmed as widely exploited, but the combination of a remote trigger and moderate CVSS score means that organizations should consider it a real threat.