CVE-2025-14854: WP-CRM System Information Disclosure

CVE-2025-14854 Overview

The WP-CRM System plugin for WordPress contains a broken access control vulnerability due to missing capability checks on critical AJAX functions. Specifically, the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status functions fail to verify user permissions, allowing authenticated attackers with minimal privileges (subscriber level and above) to access sensitive CRM data and modify system states without authorization.

Critical Impact

Authenticated attackers can enumerate CRM contact email addresses (PII disclosure) and arbitrarily modify CRM task statuses, potentially disrupting business workflows and exposing sensitive customer information.

Affected Products

• WP-CRM System plugin for WordPress versions up to and including 3.4.5
• WordPress installations with WP-CRM System plugin active
• Any website using affected versions with registered user accounts

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-14854 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-14854

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a common security weakness where an application fails to perform proper access control checks before granting users access to protected resources or functionality. The WP-CRM System plugin exposes two AJAX endpoints that can be accessed by any authenticated user, regardless of their role or capabilities within WordPress.

The wpcrm_get_email_recipients function allows retrieval of CRM contact email addresses, which constitutes personally identifiable information (PII). The wpcrm_system_ajax_task_change_status function permits modification of CRM task statuses, which could disrupt business operations and workflow management. Both functions are accessible via standard WordPress AJAX requests without verifying if the requesting user has appropriate administrative or CRM management capabilities.

Root Cause

The root cause of this vulnerability is the absence of capability checks using WordPress's built-in access control functions such as current_user_can(). The affected AJAX handler functions process requests from any authenticated user without validating whether they possess the necessary permissions to perform these privileged operations. Properly secured WordPress plugins should implement capability checks at the beginning of AJAX handlers to ensure only authorized users can execute sensitive functions.

Attack Vector

This vulnerability is exploitable over the network by any authenticated user with at least subscriber-level access. An attacker would need to register an account on the target WordPress site or compromise an existing low-privilege account. Once authenticated, the attacker can craft AJAX requests directly to the vulnerable endpoints. No user interaction from administrators or other users is required, and the attack can be performed through simple HTTP POST requests to the WordPress AJAX handler (wp-admin/admin-ajax.php) with the appropriate action parameters.

The attack enables two distinct malicious operations: enumeration of CRM contact email addresses for potential phishing campaigns or data harvesting, and manipulation of CRM task statuses which could disrupt business processes or hide evidence of unauthorized access.

Detection Methods for CVE-2025-14854

Indicators of Compromise

• Unusual AJAX requests to admin-ajax.php with actions wpcrm_get_email_recipients or wpcrm_system_ajax_task_change_status from non-administrative users
• Unexpected changes to CRM task statuses not correlating with authorized user activity
• High volume of requests to CRM-related AJAX endpoints from subscriber or contributor accounts
• Audit log entries showing CRM data access by users without CRM management responsibilities

Detection Strategies

• Implement WordPress activity logging plugins to monitor AJAX requests and flag suspicious patterns
• Review server access logs for POST requests to admin-ajax.php containing the vulnerable action parameters
• Deploy web application firewall (WAF) rules to detect and alert on unauthorized CRM data access attempts
• Configure SentinelOne Singularity to monitor for anomalous WordPress application behavior

Monitoring Recommendations

• Enable comprehensive WordPress audit logging covering all AJAX requests
• Set up alerts for CRM task status changes occurring outside business hours or from unexpected user accounts
• Monitor for bulk data extraction patterns indicating email address enumeration
• Review user access patterns to identify accounts that may have been compromised for exploitation

How to Mitigate CVE-2025-14854

Immediate Actions Required

• Update WP-CRM System plugin to a version newer than 3.4.5 when available
• Review CRM task logs for unauthorized modifications and restore any altered data
• Audit user accounts to identify potential malicious subscribers that may have exploited this vulnerability
• Consider temporarily restricting user registration if the site allows open registration

Patch Information

A patched version addressing this vulnerability should be obtained from the official WordPress plugin repository. Site administrators should monitor the WordPress Plugin Source Code repository and the Wordfence Vulnerability Analysis for update announcements. Ensure automatic updates are enabled for WordPress plugins or establish a regular update schedule.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block AJAX requests with vulnerable action parameters from non-administrative users
• Use a security plugin to restrict AJAX functionality to administrative roles only as a temporary measure
• Disable user registration on the WordPress site if not critical to business operations
• Consider deactivating the WP-CRM System plugin until a patched version is available if the risk is unacceptable

# WordPress wp-config.php hardening - disable user registration
define('USERS_CAN_REGISTER', false);

# Example .htaccess rule to restrict AJAX access (use with caution)
# Add to WordPress .htaccess to block suspicious CRM AJAX requests
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
RewriteCond %{QUERY_STRING} action=wpcrm_get_email_recipients [NC,OR]
RewriteCond %{QUERY_STRING} action=wpcrm_system_ajax_task_change_status [NC]
RewriteRule .* - [F,L]
</IfModule>