Executive brief
The ERP plugin for WordPress, used for managing HR, accounting, and customer relationships, contains a SQL injection vulnerability in its CRM contact filtering feature. Attackers with CRM Agent or higher roles can extract sensitive company and customer data from the database by manipulating filter parameters, risking exposure of employee records, financial information, and customer details.
Technical details
The vulnerability is a SQL injection flaw in the 'erpadvancefilter' parameter handled by the erp_crm_contact_advance_filter() function. The plugin applies sanitize_text_field() to user input, which does not escape single quotes, then directly interpolates the unsanitized value into a SQL WHERE clause executed via $wpdb->get_results(). An authenticated attacker with the CRM Agent role or higher (CRM Manager, WordPress admin) and the erp_crm_list_contact capability can inject arbitrary SQL to extract or manipulate database records. No patch is currently available for versions up to 1.17.4.
Affected products
- WordPress.org ERP up to 1.17.4
Timeline
- 2026-08-05: disclosed