CVE-2025-14854: WP-CRM System Information Disclosure Flaw

CVE-2025-14854 Overview

CVE-2025-14854 is a missing authorization vulnerability in the WP-CRM System plugin for WordPress, affecting all versions up to and including 3.4.5. The plugin fails to perform capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions. Authenticated users with subscriber-level access or above can exploit this flaw to enumerate CRM contact email addresses and modify CRM task statuses. The disclosed email data constitutes personally identifiable information (PII). According to the advisory, CVE-2025-62106 is likely a duplicate of this issue. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact

Authenticated subscriber-level attackers can harvest CRM contact email addresses and tamper with task workflow states, undermining data confidentiality and integrity.

Affected Products

• WP-CRM System plugin for WordPress, versions up to and including 3.4.5
• Fixed in WP-CRM System version 3.4.6
• Any WordPress site allowing subscriber-level account registration with the vulnerable plugin installed

Discovery Timeline

• 2026-01-14 - CVE-2025-14854 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14854

Vulnerability Analysis

The WP-CRM System plugin exposes two AJAX endpoints that lack proper authorization checks. The wpcrm_get_email_recipients handler returns CRM contact email addresses to any authenticated requester. The wpcrm_system_ajax_task_change_status handler updates the status of CRM task records without verifying whether the caller holds an administrative or CRM-management capability. Because WordPress registers AJAX actions through wp_ajax_{action} hooks, any logged-in user, including subscribers, can invoke them by POSTing to /wp-admin/admin-ajax.php. The plugin code paths can be inspected in the WP-CRM System 3.4.5 wcs-functions.php and the task list handler.

Root Cause

The root cause is missing current_user_can() capability checks inside the AJAX callbacks. The plugin relies on authentication alone, treating any logged-in session as authorized to read CRM contact data and mutate task state. This violates the WordPress security model, which requires explicit capability enforcement on privileged actions.

Attack Vector

An attacker first obtains a subscriber account, either through open registration or through a compromised low-privilege user. The attacker then issues authenticated AJAX requests to admin-ajax.php invoking the two vulnerable actions. The wpcrm_get_email_recipients action returns the email list usable for phishing or spam targeting. The wpcrm_system_ajax_task_change_status action lets the attacker mark tasks as complete, in progress, or other states, disrupting CRM workflows. No user interaction by an administrator is required.

Detection Methods for CVE-2025-14854

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php with the action parameter set to wpcrm_get_email_recipients or wpcrm_system_ajax_task_change_status originating from non-administrative accounts
• Unexpected changes to CRM task statuses in the WP-CRM System dashboard with audit entries tied to subscriber-level users
• Spikes in low-privilege account registrations followed by AJAX traffic to WP-CRM endpoints

Detection Strategies

• Enable WordPress audit logging plugins to capture AJAX action invocations and the authenticated user role behind each call
• Inspect web server access logs for high-frequency admin-ajax.php POSTs from a single subscriber session
• Correlate CRM task status changes against the WordPress user role of the actor performing the change

Monitoring Recommendations

• Alert on any invocation of wpcrm_get_email_recipients by users without an administrator or editor role
• Monitor outbound mail flow for sudden phishing-style campaigns referencing harvested CRM contacts
• Track subscriber-account registration rates and disable open registration where it is not required

How to Mitigate CVE-2025-14854

Immediate Actions Required

• Update the WP-CRM System plugin to version 3.4.6 or later, which adds the missing capability checks
• Audit existing WordPress user accounts and remove unused or untrusted subscriber-level users
• Review CRM task history for unauthorized status changes and restore correct values where needed
• Notify CRM contacts whose email addresses may have been exposed in line with applicable privacy obligations

Patch Information

The vendor addressed the issue in WP-CRM System version 3.4.6. The corrected code is visible in the 3.4.6 wcs-functions.php diff. Additional details are documented in the Wordfence Vulnerability Report.

Workarounds

• Disable the WP-CRM System plugin until the patched version can be installed if immediate updating is not possible
• Disable open user registration by setting Anyone can register to off under WordPress Settings → General
• Restrict access to /wp-admin/admin-ajax.php via a web application firewall rule blocking the two affected action values for non-administrative sessions

# Example WAF rule (ModSecurity-style) blocking the vulnerable AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1014854,msg:'Block WP-CRM vulnerable AJAX actions'"
  SecRule ARGS:action "@rx ^(wpcrm_get_email_recipients|wpcrm_system_ajax_task_change_status)$" \
    "t:none,t:lowercase"