CVE-2025-13093: CWE-862 Missing Authorization in ajitdas Devs CRM – Manage tasks, attendance and teams all together
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.
AI Analysis
Technical Summary
CVE-2025-13093 is a missing authorization vulnerability (CWE-862) in the Devs CRM WordPress plugin, specifically in the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint. This endpoint does not perform capability checks, enabling unauthenticated users to update lead tags. The vulnerability affects all versions up to 1.1.8 and has a CVSS 3.1 base score of 5.3, indicating a medium severity. No patch or remediation details are currently available from the vendor or advisory sources.
Potential Impact
An unauthenticated attacker can modify lead tags within the CRM by exploiting the missing authorization check on the bulk-update REST API endpoint. This impacts data integrity but does not affect confidentiality or availability according to the CVSS vector. There is no evidence of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints if possible or implement additional access controls at the web server or application firewall level to prevent unauthorized requests to '/wp-json/devs-crm/v1/bulk-update'.
CVE-2025-13093: CWE-862 Missing Authorization in ajitdas Devs CRM – Manage tasks, attendance and teams all together
Description
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-13093 is a missing authorization vulnerability (CWE-862) in the Devs CRM WordPress plugin, specifically in the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint. This endpoint does not perform capability checks, enabling unauthenticated users to update lead tags. The vulnerability affects all versions up to 1.1.8 and has a CVSS 3.1 base score of 5.3, indicating a medium severity. No patch or remediation details are currently available from the vendor or advisory sources.
Potential Impact
An unauthenticated attacker can modify lead tags within the CRM by exploiting the missing authorization check on the bulk-update REST API endpoint. This impacts data integrity but does not affect confidentiality or availability according to the CVSS vector. There is no evidence of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints if possible or implement additional access controls at the web server or application firewall level to prevent unauthorized requests to '/wp-json/devs-crm/v1/bulk-update'.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-11-12T20:43:33.736Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 693cef64d977419e584a5014
Added to database: 12/13/2025, 4:45:24 AM
Last enriched: 4/9/2026, 4:25:53 PM
Last updated: 5/10/2026, 8:18:53 AM
Views: 129
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.