CVE-2026-9004

Name of the Vulnerable Software and Affected Versions WP-CRM System – Manage Clients and Projects versions prior to 3.4.7

Description Authenticated attackers with contributor-level access and above can extract sensitive data from arbitrary CRM contact records. This is achieved by enumerating the contact id parameter, which leads to the exposure of full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical addresses.

Recommendations Update the plugin to a version newer than 3.4.6. Restrict the use of the contact id parameter to authorized users only.