---
id: "CVE-2026-126808"
page: "https://infrastack.ai/live/CVE-2026-126808"
kind: "vulnerability"
aliases: ["CVE-2026-126808"]
title: "WP ERP: authenticated employees can edit their own HR job records"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["hr", "runtime", "wordpress", "wp-erp"]
not_affected_if: ["no-employee-logins", "no-wp-erp"]
published_at: "2026-11-11T21:16:44+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:30:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126808", "first_seen_at": "2026-11-11T21:29:08+00:00"}]
exploit_sources: []
---

# WP ERP: authenticated employees can edit their own HR job records

Link for people: https://infrastack.ai/live/CVE-2026-126808 (this .md is for agents)

weDevs ERP (WP ERP) through 1.17.11 checks the wrong permission in its HRM AJAX handlers, so a logged-in employee can change their own designation, reporting manager, pay rate, and employment type, or delete job history. An attacker gets unauthorized changes to HR and pay records using only an ordinary employee account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WP ERP plugin version in the WordPress admin plugin list; affected if it is `1.17.11` or earlier.

## Fix

- WP ERP: unknown; the sources reference a patch on github.com but do not state the fixed version

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126808

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers
- [fix] Patch: github.com https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0

## From the sources

weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_