CVE-2025-13092: 
WordPress vulnerability analysis and mitigation

CVE-2025-13092 is a missing authorization vulnerability in the Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress. It affects all versions up to and including 1.1.8, allowing unauthenticated attackers to access the /wp-json/devs-crm/v1/attendances REST API endpoint without any capability check. This exposes private user data, including password hashes, to any network-accessible attacker. It carries a CVSS v3.1 base score of 5.3 (Medium) and was published on December 13, 2025 (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin's REST API endpoint /wp-json/devs-crm/v1/attendances does not enforce any WordPress capability or permission check before returning data. Because the endpoint is registered without authentication requirements, any unauthenticated HTTP GET request to the endpoint can retrieve sensitive records. No special preconditions, credentials, or user interaction are required; the attacker only needs network access to the WordPress installation (Wordfence, ENISA EUVD).

Successful exploitation allows unauthenticated remote attackers to retrieve private user data stored by the Devs CRM plugin, most critically including WordPress password hashes. Exposure of password hashes enables offline cracking attacks, which could lead to account takeover of WordPress users — including administrators — and potential full site compromise. There is no integrity or availability impact, but the confidentiality breach can serve as a stepping stone for broader lateral movement within the WordPress environment (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13092 as of the available data. The EPSS score is approximately 0.035%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the trivial exploitation mechanics — a simple unauthenticated HTTP request — mean the barrier to exploitation is extremely low for any attacker who identifies a vulnerable installation (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Devs CRM plugin (version ≤ 1.1.8) using tools like WPScan, Shodan, or by checking /wp-content/plugins/devs-crm/ for plugin presence.
2. Probe the endpoint: Send an unauthenticated HTTP GET request to the target site's REST API endpoint: GET https://<target>/wp-json/devs-crm/v1/attendances
3. Retrieve sensitive data: If the plugin is installed and vulnerable, the server responds with attendance records and associated private user data, including WordPress password hashes, without requiring any authentication token or session.
4. Offline credential cracking: Extract the returned password hashes and use offline cracking tools (e.g., Hashcat, John the Ripper) with wordlists to recover plaintext passwords.
5. Account takeover: Use recovered credentials to log into the WordPress admin panel or other services where users reuse passwords, enabling full site compromise or lateral movement (Wordfence).

• Network: Unauthenticated HTTP GET requests to /wp-json/devs-crm/v1/attendances from external or unexpected IP addresses; high-frequency requests to this endpoint suggesting automated scanning.
• Logs: WordPress access logs (access.log) showing GET /wp-json/devs-crm/v1/attendances with HTTP 200 responses from unauthenticated sessions (no Authorization header or valid nonce); repeated requests from the same IP or user-agent string.
• File System: No direct file-system artifacts expected from read-only data exfiltration; however, subsequent compromise may leave web shells or modified plugin files in /wp-content/plugins/devs-crm/.
• Process/Behavior: Unusual outbound connections from the web server following API access, potentially indicating follow-on exploitation after credential recovery.

The primary remediation is to update the Devs CRM plugin to a version beyond 1.1.8 that includes a proper capability check on the REST API endpoint. Site administrators should check the WordPress plugin page for the latest patched release. As an immediate workaround, if no patch is available or the plugin is not actively needed, deactivate or remove the plugin entirely. Additionally, administrators should audit user accounts for signs of unauthorized access and consider forcing a password reset for all users, as hashes may have already been exposed (Wordfence, WordPress Plugin).