{"id":"CVE-2026-126808","kind":"vulnerability","aliases":["CVE-2026-126808"],"related":[],"title":"WP ERP: authenticated employees can edit their own HR job records","description":"weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.","summary":"weDevs ERP (WP ERP) through 1.17.11 checks the wrong permission in its HRM AJAX handlers, so a logged-in employee can change their own designation, reporting manager, pay rate, and employment type, or delete job history. An attacker gets unauthorized changes to HR and pay records using only an ordinary employee account.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hr","runtime","wordpress","wp-erp"],"not_affected_if":["no-employee-logins","no-wp-erp"],"how_to_check":"- Check the installed WP ERP plugin version in the WordPress admin plugin list; affected if it is `1.17.11` or earlier.","fix":"- WP ERP: unknown; the sources reference a patch on github.com but do not state the fixed version","status":"open","published_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:56+00:00","updated_at":"2026-11-11T21:30:56+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T21:30:56Z","model":"claude-haiku-5-5","output":{"fix":"- WP ERP: unknown; the sources reference a patch on github.com but do not state the fixed version","reach":"network","title":"WP ERP: authenticated employees can edit their own HR job records","impact":"medium","summary":"weDevs ERP (WP ERP) through 1.17.11 checks the wrong permission in its HRM AJAX handlers, so a logged-in employee can change their own designation, reporting manager, pay rate, and employment type, or delete job history. An attacker gets unauthorized changes to HR and pay records using only an ordinary employee account.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-erp","hr"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"employee changes own pay rate and job history records","analyst_note":"Confirm the fixed version from the linked GitHub patch and the vendor release notes; the sources do not state it.","how_to_check":"- Check the installed WP ERP plugin version in the WordPress admin plugin list; affected if it is `1.17.11` or earlier.\n- unknown whether a fixed version exists in the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-wp-erp","no-employee-logins"],"who_is_affected":"Sites running the WP ERP HR module on WordPress where employees have logged-in accounts. Sites without WP ERP, or where no one but administrators can log in, are not exposed to this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4631,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126808':14A,17A '-2026':13A,16A '1.17.11':29B,82C 'account':76B 'ajax':37B,100C 'allow':89C 'attack':62B,111C 'authent':3A,90C 'author':86C 'chang':46B,65B,124C 'check':30B,102C 'contain':83C 'cve':12A,15A 'delet':58B,134C 'design':49B,125C 'edit':6A,93C,104C 'employ':55B,131C 'employe':4A,44B,75B,91C,105C 'erp':2A,23B,25B,27B,78C,80C,103C,108C 'get':63B 'handler':38B,101C 'histori':60B,136C 'hr':9A,18B,67B,96C 'hrm':36B,99C 'id':117C 'incorrect':85C 'instead':106C 'job':10A,59B,135C 'jobinfo':110C 'log':42B 'logged-in':41B 'manag':51B,109C,127C 'nonc':122C 'ordinari':74B 'pay':52B,69B,128C 'permiss':33B 'post':113C 'profil':121C 'rate':53B,129C 'record':11A,70B,97C 'report':50B,126C 'runtim':19B 'type':56B,132C 'unauthor':64B 'use':71B 'user':116C 'vulner':87C 'wedev':24B,77C 'wordpress':20B 'wp':1A,22B,26B,79C 'wp-erp':21B 'wrong':32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP ERP HR module on WordPress where employees have logged-in accounts. Sites without WP ERP, or where no one but administrators can log in, are not exposed to this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hr","medium","runtime","wordpress","wperp"],"campaign_type":null,"search_a":"'-126808':14A,17A '-2026':13A,16A 'authent':3A 'cve':12A,15A 'edit':6A 'employe':4A 'erp':2A 'hr':9A 'job':10A 'record':11A 'wp':1A","search_b":"'1.17.11':29B 'account':76B 'ajax':37B 'attack':62B 'chang':46B,65B 'check':30B 'delet':58B 'design':49B 'employ':55B 'employe':44B,75B 'erp':23B,25B,27B 'get':63B 'handler':38B 'histori':60B 'hr':18B,67B 'hrm':36B 'job':59B 'log':42B 'logged-in':41B 'manag':51B 'ordinari':74B 'pay':52B,69B 'permiss':33B 'rate':53B 'record':70B 'report':50B 'runtim':19B 'type':56B 'unauthor':64B 'use':71B 'wedev':24B 'wordpress':20B 'wp':22B,26B 'wp-erp':21B 'wrong':32B","search_c":"'1.17.11':82C 'ajax':100C 'allow':89C 'attack':111C 'authent':90C 'author':86C 'chang':124C 'check':102C 'contain':83C 'delet':134C 'design':125C 'edit':93C,104C 'employ':131C 'employe':91C,105C 'erp':78C,80C,103C,108C 'handler':101C 'histori':136C 'hr':96C 'hrm':99C 'id':117C 'incorrect':85C 'instead':106C 'job':135C 'jobinfo':110C 'manag':109C,127C 'nonc':122C 'pay':128C 'post':113C 'profil':121C 'rate':129C 'record':97C 'report':126C 'type':132C 'user':116C 'vulner':87C 'wedev':77C 'wp':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126808","severity":null,"published_at":"2026-11-11T21:16:44+00:00","modified_at":"2026-11-11T21:16:44+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128981,"url":"https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128982,"url":"https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}