The vulnerability allows authenticated users with contributor-level access or higher to read the full contact details of any CRM record by sending requests that include the contact_id parameter. The disclosed data includes names, e‑mail addresses, phone numbers, mobile numbers, fax numbers and physical addresses. This breach affects the confidentiality of personal data but does not provide further capabilities such as privilege escalation or denial of service. The weakness is a classic case of sensitive information exposure identified as CWE‑200.

The WordPress plugin Product: nofearinc WP‑CRM System – Manage Clients and Projects is affected in all releases up to and including version 3.4.6. Any WordPress site using one of these versions is vulnerable.

The CVSS score of 4.3 rates the issue as moderate. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires authenticated access and the enumeration of contact_id values, the exploitation vector is likely an authenticated web request against the plugin’s address book endpoint. The risk is therefore limited to users or administrators who have contributor or higher privileges. While no public exploitation has been reported, any authenticated attacker can harvest sensitive personal details from the CRM, which may lead to phishing or identity‑theft risks.