4.3Orta
CVE-2026-126808WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
Açıklama
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Zayıflık türü (CWE):
CWE-863
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| jerryhanjj | erp | ≤ 1.17.11 | |
| weDevs | ERP | ≤ 1.17.11 |
Kaynaklar ve yamalar
- https://github.com/wp-erp/wp-erp/issues/1691 issue-tracking
- https://github.com/wp-erp/wp-erp/pull/1693 issue-trackingpatch
- https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0 patch
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225 technical-description
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263 technical-description
- VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers third-party-advisory