CVE-2025-10746: 
WordPress vulnerability analysis and mitigation

The Integrate Dynamics 365 CRM plugin for WordPress contains a vulnerability (CVE-2025-10746) affecting all versions up to and including 1.0.9. The vulnerability was discovered and disclosed on October 3, 2025, and involves missing authorization checks that could allow unauthorized access to critical plugin functions (NVD).

The vulnerability stems from missing capability checks and nonce verification on functions hooked to 'init'. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) (NVD, Wordfence).

Unauthenticated attackers can exploit this vulnerability to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data. This is possible through direct requests to vulnerable endpoints when crafting malicious requests with specific parameters (NVD).

The vulnerability is exploitable remotely by unauthenticated attackers with low attack complexity and requires no user interaction. The attack vector is network-accessible, making it relatively straightforward to exploit given the proper knowledge of the vulnerable endpoints (NVD).