4.3Media
CVE-2026-126808WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
Descripción
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Debilidad (CWE):
CWE-863
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| jerryhanjj | erp | ≤ 1.17.11 | |
| weDevs | ERP | ≤ 1.17.11 |
Referencias y parches
- https://github.com/wp-erp/wp-erp/issues/1691 issue-tracking
- https://github.com/wp-erp/wp-erp/pull/1693 issue-trackingpatch
- https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0 patch
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225 technical-description
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263 technical-description
- VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers third-party-advisory