4.3Mittel
CVE-2026-126808WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
Beschreibung
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Schwachstellentyp (CWE):
CWE-863
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| jerryhanjj | erp | ≤ 1.17.11 | |
| weDevs | ERP | ≤ 1.17.11 |
Referenzen und Patches
- https://github.com/wp-erp/wp-erp/issues/1691 issue-tracking
- https://github.com/wp-erp/wp-erp/pull/1693 issue-trackingpatch
- https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0 patch
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225 technical-description
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263 technical-description
- VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers third-party-advisory