CVE-2025-13093: 
WordPress vulnerability analysis and mitigation

CVE-2025-13093 is a Missing Authorization vulnerability in the Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress. Due to a missing capability check on the /wp-json/devs-crm/v1/bulk-update REST API endpoint, unauthenticated attackers can modify lead tags without any authentication. All versions up to and including 1.1.8 are affected. The vulnerability was published on December 13, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization): the plugin's REST API endpoint /wp-json/devs-crm/v1/bulk-update does not perform any capability or permission check before processing requests, allowing any network-accessible client to invoke it without credentials. An attacker simply sends a crafted HTTP request to this endpoint to trigger unauthorized bulk updates of lead tags stored in the CRM. No authentication, elevated privileges, or user interaction is required, making exploitation trivial over the network (Wordfence, ENISA EUVD).

Successful exploitation allows unauthenticated remote attackers to arbitrarily modify lead tags within the Devs CRM plugin, directly affecting the integrity of CRM data. There is no confidentiality or availability impact — attackers cannot read sensitive data or disrupt service through this vulnerability alone. However, manipulation of lead tags could corrupt business workflows, mislabel customer records, or facilitate social engineering by altering CRM metadata (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-13093. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The assigning authority is Wordfence, which discovered and disclosed the issue (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Devs CRM plugin (version ≤ 1.1.8) by scanning for the plugin's presence via common WordPress enumeration techniques (e.g., checking /wp-content/plugins/devs-crm/ or using tools like WPScan).
2. Identify the vulnerable endpoint: Confirm the REST API endpoint is accessible at https://<target>/wp-json/devs-crm/v1/bulk-update.
3. Craft the malicious request: Construct an HTTP POST (or applicable method) request to the endpoint with a payload specifying the lead IDs and desired tag values to be updated — no authentication headers or nonces are required.
4. Submit the request: Send the crafted request directly to the endpoint. Because no capability check is enforced, the server processes the update and modifies lead tags in the CRM database.
5. Verify impact: Confirm the unauthorized data modification by observing changes in the CRM lead records (Wordfence).

• Network: Unexpected or repeated HTTP POST requests to /wp-json/devs-crm/v1/bulk-update from unauthenticated or unknown IP addresses in web server access logs.
• Logs: WordPress access logs showing requests to the bulk-update REST API endpoint without associated authentication cookies or nonce values; unusual volume of bulk-update calls in a short timeframe.
• Application: Unexplained or unauthorized changes to lead tags within the Devs CRM plugin dashboard, particularly bulk changes not initiated by known users.

As of the disclosure date (December 13, 2025), no patched version beyond 1.1.8 was confirmed available. Site administrators should deactivate and remove the Devs CRM plugin until a patched version is released by the vendor (ajitdas). As a temporary workaround, restrict access to the WordPress REST API for unauthenticated users using a security plugin (e.g., Wordfence, iThemes Security) or server-level rules blocking unauthenticated access to /wp-json/devs-crm/ endpoints. Monitor the WordPress plugin page for an updated release (Wordfence, WordPress Plugin).