GHSA-p5g3-q37q-686cMediumCVSS 4.3
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-126808
- https://github.com/wp-erp/wp-erp/issues/1691
- https://github.com/wp-erp/wp-erp/pull/1693
- https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263
- https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers
- https://github.com/advisories/GHSA-p5g3-q37q-686c