WordPress Plugin Vulnerabilities

WP-CRM System < 3.4.0 - Unauthenticated Duplicate Contact Settings Update

Description

The plugin is vulnerable to unauthorized access due to a missing capability on the wpcrm_save_duplicate_contact_option() function, allowing unauthenticated attackers to update the duplicate contact settings

Affects Plugins

Plugin icon
wp-crm-system
Fixed in 3.4.0

References

CVE
CVE-2024-55991
URL
https://patchstack.com/database/wordpress/plugin/wp-crm-system/vulnerability/wordpress-crm-plugin-wp-crm-system-plugin-3-2-9-1-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Mika
Verified
Yes
WPVDB ID
690b9337-a598-45d2-ab12-47424f9e6e07

Timeline

Publicly Published
2024-12-14 (about 1 year ago)
Added
2025-01-17 (about 1 year ago)
Last Updated
2025-01-24 (about 1 year ago)

Other

Published
Title
Published
2024-11-25
Title
Spam protection, Anti-Spam, FireWall by CleanTalk < 6.45 - Unauthenticated Arbitrary Plugin Installation
Published
2025-04-17
Title
Advanced Google Maps < 5.8.5 - Missing Authorization
Published
2026-03-20
Title
Canto < 3.1.2 - Missing Authorization to Unauthenticated File Upload
Published
2025-12-15
Title
Yaad Sarig Payment Gateway For WC <= 2.2.10 - Missing Authorization
Published
2024-06-20
Title
Laybuy Payment Extension for WooCommerce <= 5.3.9 - Missing Authorization