CVE-2026-105191 · Package
NO FIX YET · SEE WHAT TO DO
The ERP suite for WooCommerce WordPress plugin, before version 1.17.11, has an AJAX action that returns stored before-and-after values of record changes without a capability check. Any authenticated user, including Subscribers, can read other users' sensitive HR, CRM and accounting data by enumerating record identifiers.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 are exposed. Any site that lets people register or log in as a low-privilege user, such as a Subscriber, can be read by those accounts. Sites where the plugin is not installed, or where user registration is closed and all accounts are trusted staff, carry lower risk.
Not affected if no-open-registration, plugin-1.17.11-or-later, plugin-not-installed
Who cares accounting, erp, hr-data, woocommerce, wordpress
1.17.11 or laterThe ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.