CVE-2026-9004

Description

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 4.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Effective score: 4.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-200
Reserved: 2026-05-19
Published: 2026-09-22 07:41 UTC
Last updated: 2026-09-22 10:25 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9004.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 08:16:43 UTC
NVD last modified: 2026-09-22 19:04:55 UTC
NVD CVSS v3.1: 4.3 / 10 MEDIUM source: security@wordfence.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 1.4 / 10
EPSS score: 0.0022 (probability of exploitation in next 30 days)
EPSS percentile: 12.45% vs all CVEs — higher = more likely to be exploited, as of 2026-09-22

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84309
Assigner: Wordfence
Published: Sep 22, 2026, 7:41:15 AM
Updated: Sep 22, 2026, 10:25:31 AM
EUVD base score (CVSS 3.1): 4.3 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EUVD-reported EPSS: 0.2200
Vendors: nofearinc
Products: WP-CRM System – Manage Clients and Projects (0 ≤3.4.6)
Aliases: GHSA-c4f5-f4rw-hrjw

ENISA description: The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
nofearinc	WP-CRM System – Manage Clients and Projects	`0` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L12 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L33 security@wordfence.com
https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L75 security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/f506a9bd-2501-4437-938d-2833fc8545a9?source=cve security@wordfence.com

Remediations (10)

CVE-2026-9004 - Vulnerability Details - OpenCVE

web:app.opencve.io

The WP-CRM System - Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address ...

2026-09-23 15:39 UTC
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives ...

web:blog.qualys.com

What can I do before Microsoft releases a patch ? Qualys TruRisk™ Eliminate provides a recommended mitigation for CVE - 2026 -69414 that can be applied to affected systems while Microsoft works on a fix . Assets can then be reassessed in Qualys VMDR to verify the remediation outcome.

2026-09-23 15:39 UTC
Alert CISA Adds Two Known Exploited Vulnerabilities to Catalog Release ...

web:community.opentextcybersecurity.com

BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

2026-09-23 15:39 UTC
CVE-2026-9004: Nofearinc Vulnerability (CVSS 4.3) | CVETodo

web:cvetodo.com

CVE-2026-9004 is a CVSS 4.3 medium-severity vulnerability. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-23 15:39 UTC
Cisco Advance Notification for Publication of September 16, 2026 ...

web:sec.cloudapps.cisco.com

On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...

2026-09-23 15:39 UTC
CISA BOD 26-04: The End of Patch-Everything and the Start of the 3-Day ...

web:securityboulevard.com

The End of Patch -Everything and the Start of the 3-Day Clock TL;DR What it is: CISA Binding Operational Directive (BOD) 26-04, issued on June 10, 2026 , replaces flat, severity-based patch deadlines with a four-factor risk model: asset exposure, KEV status, exploit automatability, and technical impact.

2026-09-23 15:39 UTC
CVE-2026-9004 - vulnerability database | Vulners.com

web:vulners.com

CVE-2026-9004 🗓️ 22 Sep 2026 00:41:15 Reported by Wordfence Type cve 🔗 web.nvd.nist.gov 👁 7 Views

2026-09-23 15:39 UTC
CVE-2026-9004: nofearinc WP-CRM System - Rapid7

web:www.rapid7.com

CVE-2026-9004 : nofearinc WP-CRM System - Manage Clients and Projects: The WP-CRM System - Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in…. View severity, references, and remediation details from Rapid7.

2026-09-23 15:39 UTC
CVE-2026-9004: WP-CRM System - Manage Clients and Projects…

web:www.strix.ai

How severe is CVE-2026-9004 ? CVE-2026-9004 has a CVSS score of 4.3/10 (MEDIUM severity). How do I fix CVE-2026-9004 ? Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

2026-09-23 15:39 UTC
CVE-2026-9004 - Tenable

web:www.tenable.com

The WP-CRM System - Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address ...

2026-09-23 15:39 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-9004.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9004",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T10:08:02.719959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T10:25:31.220Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP-CRM System \u2013 Manage Clients and Projects",
          "vendor": "nofearinc",
          "versions": [
            {
              "lessThanOrEqual": "3.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Teerachai Somprasong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP-CRM System \u2013 Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract full names, email addresses, phone numbers, mobile numbers, fax numbers, and physical address information of arbitrary CRM contact records by enumerating the contact_id parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T07:41:15.821Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f506a9bd-2501-4437-938d-2833fc8545a9?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L33"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L12"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-crm-system/tags/3.4.6/includes/wcs-dashboard-address-book.php#L75"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-19T13:59:25.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-21T19:26:14.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-9004",
    "datePublished": "2026-09-22T07:41:15.821Z",
    "dateReserved": "2026-05-19T13:44:14.210Z",
    "dateUpdated": "2026-09-22T10:25:31.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}