CVE-2025-62106
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62106 is a broken access control vulnerability in the WordPress WP-CRM System Plugin up to version 3.4.5. It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows users with low privileges (Subscriber-level) to perform actions that should be restricted to higher-privileged users like Developers. [1]
How can this vulnerability impact me? :
This vulnerability allows unprivileged users to perform actions intended for higher-privileged users, potentially leading to unauthorized changes or access within the WP-CRM System. However, it is considered to have a low severity impact with a CVSS score of 5.4 and is unlikely to be exploited in a way that causes significant harm. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying if your WordPress installation is running WP-CRM System Plugin version 3.4.5 or earlier. Since the issue is due to missing authorization checks allowing Subscriber-level users to perform higher-privilege actions, monitoring for unusual privilege escalations or unauthorized actions by low-privilege users can help detect exploitation attempts. Specific commands are not provided, but checking the plugin version via WordPress admin or using WP-CLI commands like 'wp plugin list' to verify the plugin version can be useful. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the WP-CRM System Plugin to version 3.4.6 or later, where the vulnerability is fixed. Additionally, enabling auto-updates for the plugin can help prevent future risks. Monitoring user privileges and restricting Subscriber-level users from performing sensitive actions until the update is applied is also advisable. [1]