CVE-2025-14854 describes a missing authorization vulnerability (CWE-862) in the WP-CRM System plugin for WordPress, affecting all versions up to 3.4.5. The issue arises from the lack of capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_status AJAX functions. Authenticated users with subscriber-level privileges can enumerate CRM contact email addresses, exposing personally identifiable information (PII), and can also modify CRM task statuses. This vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality and integrity but not availability.

An attacker with subscriber-level access can disclose CRM contact email addresses, leading to PII exposure, and can alter task statuses within the CRM system, potentially disrupting project management workflows. The vulnerability does not affect system availability. There are no reported exploits in the wild, and the impact is limited to users who already have authenticated access at subscriber level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user access to trusted individuals and monitor for unusual activity related to CRM contact data and task status changes. Avoid granting unnecessary privileges to low-level authenticated users.