CVE-2025-32224 MEDIUM

CVE-2025-32224: WordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerability

Vendor Shivam Mani Tripathi
Product Privyr CRM Integration
Weakness CWE-862 · Missing authorization
Published April 4, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Shivam Mani Tripathi Privyr CRM Integration privy-crm-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Privyr CRM Integration: from n/a through <= 1.0.2.

Explanation of Vulnerability in Simple Terms

02Summary

Privyr CRM Integration versions 1.0.2 and earlier lack proper authorization checks, allowing authenticated users to modify or disable functionality they should not access. An attacker with low-level credentials can alter data or disrupt service availability. Update to a version newer than 1.0.2 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Modify or disable CRM data and functionality without proper authorization.

Potential impact on your site

04Site Impact

Unauthorized users can alter CRM records or cause service disruption affecting business operations.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the system.

Key dates

06Disclosure timeline

April 4, 2025 CVE published
May 12, 2026 Record updated