CVE-2026-126808
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
References
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263
- https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0
- https://github.com/wp-erp/wp-erp/issues/1691
- https://github.com/wp-erp/wp-erp/pull/1693