CVE-2026-9004: WP-CRM System Information Disclosure Flaw

CVE-2026-9004 Overview

CVE-2026-9004 is a Sensitive Information Exposure vulnerability [CWE-200] in the WP-CRM System – Manage Clients and Projects plugin for WordPress. The flaw affects all versions up to and including 3.4.6 and stems from insufficient authorization checks on the contact_id parameter. Authenticated attackers with contributor-level access or higher can enumerate contact_id values to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical addresses of arbitrary CRM contact records. The vulnerability requires low privileges and no user interaction, exposing customer relationship management data stored by site operators.

Critical Impact
Authenticated contributors can enumerate CRM contact IDs and harvest personally identifiable information (PII) on every stored contact, enabling downstream phishing, fraud, and privacy-regulation exposure.

Affected Products

WP-CRM System – Manage Clients and Projects plugin for WordPress
All plugin versions up to and including 3.4.6
WordPress sites permitting contributor-level or higher registration

Discovery Timeline

2026-09-22 - CVE-2026-9004 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-9004

Vulnerability Analysis

The vulnerability resides in the plugin's address book handling logic within includes/wcs-dashboard-address-book.php. The affected code paths retrieve CRM contact records based on the contact_id request parameter without verifying that the requesting user is authorized to view the referenced record. Because the plugin trusts the supplied identifier, any authenticated user at contributor role or above can iterate the numeric contact_id space and receive full contact details in response. The disclosed fields include names, email addresses, phone numbers, mobile numbers, fax numbers, and postal addresses, which together constitute PII that is subject to privacy regulations such as GDPR and CCPA. WordPress sites that allow open registration or self-service contributor accounts substantially widen the attacker population.

Root Cause

The root cause is a missing authorization check, a classic instance of Insecure Direct Object Reference. The plugin performs authentication checks sufficient to admit contributors but does not enforce object-level access control tying a contact_id to the requesting user's permissions or ownership. Reviewing the referenced code lines at wcs-dashboard-address-book.php line 12, line 33, and line 75 shows contact retrieval logic that does not scope results by capability or ownership.

Attack Vector

The attack vector is network-based over HTTP(S) against the WordPress admin surface. An authenticated attacker holding a contributor account issues sequential requests against the vulnerable endpoint while incrementing the contact_id parameter. Each response returns the associated contact record. Because enumeration is trivial, an attacker can script the extraction of the entire CRM address book. No exploit code is publicly indexed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-9004

Indicators of Compromise

Sequential or high-volume requests from an authenticated session referencing the contact_id parameter within wp-admin traffic tied to the WP-CRM System plugin.
Contributor or author accounts generating admin-area traffic patterns inconsistent with content-editing behavior.
Unusual outbound egress of CRM data following contributor logins, including bulk HTTP responses containing contact fields.

Detection Strategies

Deploy web application firewall (WAF) rules that flag rapid enumeration of the contact_id parameter from a single authenticated session.
Audit WordPress access logs for repeated GET or POST requests to WP-CRM System dashboard endpoints originating from non-administrator accounts.
Review the plugin version in use across WordPress estates and flag any deployment running 3.4.6 or earlier.

Monitoring Recommendations

Enable verbose logging on WordPress user activity, particularly role assignments and contributor logins.
Alert on authentication events for contributor accounts that have not previously accessed CRM plugin pages.
Correlate WordPress plugin telemetry with outbound network egress volumes to detect scripted PII exfiltration.

How to Mitigate CVE-2026-9004

Immediate Actions Required

Update WP-CRM System – Manage Clients and Projects to a version newer than 3.4.6 once the vendor publishes a patched release.
Audit existing WordPress user accounts and remove or downgrade unnecessary contributor-or-higher accounts.
Disable open user registration or restrict the default new-user role to subscriber where feasible.

Patch Information

At the time of NVD publication, all versions up to and including 3.4.6 are vulnerable. Site operators should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for the fixed release and apply it immediately after publication.

Workarounds

Deactivate the WP-CRM System plugin until a patched version is available if CRM functionality is not business-critical.
Restrict access to wp-admin using IP allowlists or HTTP authentication so only trusted operators can reach the vulnerable endpoints.
Deploy a WAF rule that blocks requests containing the contact_id parameter from user sessions below administrator role.

bash

# Example WAF rule (ModSecurity) to block contact_id enumeration by non-admin sessions
SecRule REQUEST_URI "@contains wcs-dashboard-address-book" \
    "id:1009004,phase:2,deny,status:403,\
    msg:'CVE-2026-9004 WP-CRM contact_id enumeration attempt',\
    chain"
    SecRule ARGS:contact_id "@rx ^[0-9]+$" \
        "chain"
        SecRule REQUEST_HEADERS:Cookie "!@contains wordpress_logged_in_admin"