PT-2026-96674
CVE-2026-9004
·
تاريخ النشر
2026-09-22
·
تاريخ التحديث
2026-10-02
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
WP-CRM System – Manage Clients and Projects versions prior to 3.4.7
Description
Authenticated attackers with contributor-level access and above can extract sensitive data from arbitrary CRM contact records. This is achieved by enumerating the
contact id parameter, which leads to the exposure of full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical addresses.Recommendations
Update the plugin to a version newer than 3.4.6.
Restrict the use of the
contact id parameter to authorized users only. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾