{"id":"CVE-2026-105191","kind":"vulnerability","aliases":["CVE-2026-105191"],"related":[],"title":"WordPress ERP plugin: any logged-in user can read HR and accounting records","description":"The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.","summary":"The ERP suite for WooCommerce WordPress plugin, before version 1.17.11, has an AJAX action that returns stored before-and-after values of record changes without a capability check. Any authenticated user, including Subscribers, can read other users' sensitive HR, CRM and accounting data by enumerating record identifiers.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["accounting","erp","hr-data","package","woocommerce","wordpress"],"not_affected_if":["no-open-registration","plugin-1.17.11-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin in the WordPress admin plugins list\n- Confirm whether any customer or staff accounts with the Subscriber role can log in to the site","fix":"- Update the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin to `1.17.11` or later","status":"open","published_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:43+00:00","updated_at":"2026-11-04T06:26:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin to `1.17.11` or later","reach":"internet","title":"WordPress ERP plugin: any logged-in user can read HR and accounting records","impact":"medium","summary":"The ERP suite for WooCommerce WordPress plugin, before version 1.17.11, has an AJAX action that returns stored before-and-after values of record changes without a capability check. Any authenticated user, including Subscribers, can read other users' sensitive HR, CRM and accounting data by enumerating record identifiers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","erp","hr-data","accounting"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"any logged-in user reads other users' HR, CRM and accounting records","analyst_note":"","how_to_check":"- Check the installed version of the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin in the WordPress admin plugins list\n- Confirm whether any customer or staff accounts with the Subscriber role can log in to the site","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.17.11-or-later","no-open-registration"],"who_is_affected":"Sites running the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 are exposed. Any site that lets people register or log in as a low-privilege user, such as a Subscriber, can be read by those accounts. Sites where the plugin is not installed, or where user registration is closed and all accounts are trusted staff, carry lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4158,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105191':17A,20A '-2026':16A,19A '1.17.11':38B,90C 'account':13A,21B,71B,81C,128C 'action':42B,100C 'ajax':41B,99C 'allow':114C 'authent':59B,116C 'before-and-aft':46B,105C 'built':84C 'capabl':56B,95C 'chang':53B,113C 'check':57B,96C 'complet':79C 'crm':69B,82C,126C 'cve':15A,18A 'data':25B,72B,129C 'enumer':74B,131C 'erp':2A,22B,30B,78C 'hr':11A,24B,68B,80C,125C 'hr-data':23B 'identifi':76B,133C 'includ':61B,118C 'log':6A 'logged-in':5A 'packag':26B 'perform':93C 'plugin':3A,35B,88C 'read':10A,64B,121C 'record':14A,52B,75B,112C,132C 'return':44B,102C 'sensit':67B,124C 'store':45B,104C 'subscrib':62B,119C 'suit':31B,83C 'user':8A,60B,66B,117C,123C 'valu':50B,109C 'version':37B 'without':54B 'woocommerc':27B,33B,86C 'wordpress':1A,28B,34B,87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 are exposed. Any site that lets people register or log in as a low-privilege user, such as a Subscriber, can be read by those accounts. Sites where the plugin is not installed, or where user registration is closed and all accounts are trusted staff, carry lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["accounting","erp","high","hrdata","package","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105191","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105191","severity":null,"published_at":"2026-11-04T06:16:57+00:00","modified_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}