Live › vulnerability › CVE-2026-25448
WP ERP, a WordPress plugin from weDevs, has a missing authorization check that allows access-control misconfiguration to be exploited. The sources say the flaw affects WP ERP up to version 1.17.10 and rate it medium (CVSS 4.3).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
No product ranges from the sources yet.
wp plugin get erp --field=version if WP-CLI is available.1.17.10; the sources say versions through 1.17.10 are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.
This page as .md · .json · in your agent: get_signal("CVE-2026-25448")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.