CVE-2026-126808 · Runtime
NO FIX YET · SEE WHAT TO DO
weDevs ERP (WP ERP) through 1.17.11 checks the wrong permission in its HRM AJAX handlers, so a logged-in employee can change their own designation, reporting manager, pay rate, and employment type, or delete job history. An attacker gets unauthorized changes to HR and pay records using only an ordinary employee account.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the WP ERP HR module on WordPress where employees have logged-in accounts. Sites without WP ERP, or where no one but administrators can log in, are not exposed to this flaw.
Not affected if no-employee-logins, no-wp-erp
Who cares hr, wordpress, wp-erp
1.17.11 or earlier.weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.