The WP-CRM System plugin by Mario Peshev suffers from a deserialization of untrusted data vulnerability (CVE-2025-47629) in versions up to 3.4.5. This flaw allows an attacker with high privileges to inject malicious objects during the deserialization process, potentially leading to full system compromise. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation of this vulnerability can result in full compromise of the affected WP-CRM System plugin, impacting confidentiality, integrity, and availability of the system. Because the attack requires high privileges, it is primarily a risk in environments where an attacker already has elevated access. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the WP-CRM System plugin and monitor for suspicious activity related to object injection attempts.