{"id":"CVE-2026-25448","kind":"vulnerability","aliases":["CVE-2026-25448"],"related":[],"title":"WP ERP: missing authorization lets users reach restricted access controls","description":"Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.","summary":"WP ERP, a WordPress plugin from weDevs, has a missing authorization check that allows access-control misconfiguration to be exploited. The sources say the flaw affects WP ERP up to version 1.17.10 and rate it medium (CVSS 4.3).","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","wedevs","wordpress","wp-erp"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP ERP plugin version in the WordPress admin plugins list, or with `wp plugin get erp --field=version` if WP-CLI is available.\n- Compare the result against `1.17.10`; the sources say versions through 1.17.10 are affected.","fix":"- WP ERP: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-10-29T15:17:22+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:27:03+00:00","updated_at":"2026-10-29T15:27:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T15:27:03Z","model":"claude-haiku-5-5","output":{"fix":"- WP ERP: unknown (sources do not name a fixed version)","reach":"unknown","title":"WP ERP: missing authorization lets users reach restricted access controls","impact":"medium","summary":"WP ERP, a WordPress plugin from weDevs, has a missing authorization check that allows access-control misconfiguration to be exploited. The sources say the flaw affects WP ERP up to version 1.17.10 and rate it medium (CVSS 4.3).","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-erp","weDevs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the fixed WP ERP version and the exact access-control scope from the Wordfence or weDevs advisory; the NVD entry alone does not give them.","how_to_check":"- Check the installed WP ERP plugin version in the WordPress admin plugins list, or with `wp plugin get erp --field=version` if WP-CLI is available.\n- Compare the result against `1.17.10`; the sources say versions through 1.17.10 are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":4106,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-25448':13A,16A '1.17.10':55B,85C '4.3':61B 'access':9A,38B,74C 'access-control':37B 'affect':49B,79C 'allow':36B,70C 'author':4A,33B,63C 'check':34B 'configur':73C 'control':10A,39B,75C 'cve':11A,14A 'cvss':60B 'erp':2A,22B,24B,51B,68C,69C,81C 'exploit':43B,71C 'flaw':48B 'incorrect':72C 'issu':78C 'let':5A 'levels.this':77C 'medium':59B 'misconfigur':40B 'miss':3A,32B,62C 'n/a':83C 'plugin':27B 'rate':57B 'reach':7A 'restrict':8A 'say':46B 'secur':76C 'sourc':45B 'user':6A 'version':54B 'vulner':64C 'wedev':18B,29B,66C 'wordpress':19B,26B 'wp':1A,21B,23B,50B,67C,80C 'wp-erp':20B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-25448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25448","severity":null,"published_at":"2026-10-29T15:17:22+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}