Devs CRM WordPress Plugin Missing Authorization Vulnerability in Bulk Update REST API Endpoint
Vulnerability
A vulnerability exists in the Devs CRM WordPress plugin, specifically in versions through 1.1.8, allowing unauthorized data modification. The issue arises from a lack of capability checks on the '/wp-json/devs-crm/v1/bulk-update' REST API endpoint. This flaw enables unauthenticated attackers to alter lead tags.
Impact
Exploitation of this vulnerability allows for unauthorized users to modify lead tags, potentially leading to mismanagement of task and attendance data.
Added: Dec 13, 2025, 5:17 PM
Updated: Dec 13, 2025, 5:17 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
7.4remediation
0.0relevance
1.5threat
0.0urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.