The WP-CRM System plugin for WordPress, versions up to and including 3.4.2, contains a missing authorization vulnerability (CVE-2025-49270). This vulnerability allows unauthenticated attackers to access functionality that is not properly constrained by access control mechanisms, potentially enabling unauthorized actions within the system. The issue is classified under missing authorization, affecting integrity but not confidentiality or availability. The CVSS 3.1 base score is 5.3 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, and unchanged scope.

Unauthorized users can access and potentially manipulate functionality within the WP-CRM System plugin that should be restricted, leading to integrity impacts. There is no impact on confidentiality or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying principle of least privilege and restricting access to the plugin's administrative interfaces may reduce risk but are not guaranteed mitigations for this specific vulnerability.