CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.
Explanation of Vulnerability in Simple Terms
Devs CRM versions up to 1.1.8 lack proper authorization checks, allowing unauthenticated attackers to modify data through network requests. The vulnerability does not expose sensitive information or disrupt service availability, but attackers can alter records without needing credentials or user interaction. Site administrators should update to a version newer than 1.1.8 immediately.
What an attacker can do
Modify or alter data in the CRM without authentication.
Potential impact on your site
Unauthorized changes to tasks, attendance records, or team data without audit trail or user consent.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
