Is CVE-2026-126808 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126808 being exploited in the wild.

How severe is CVE-2026-126808?

Medium severity, with a CVSS score of 4.3, published 11 November 2026.

Is there a fix for CVE-2026-126808?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-126808 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126808?

Check whether you run weDevs WP ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126808: weDevs ERP authorization bypass in employee profile editing

CVE-2026-126808 · Severity: medium · CVSS 4.3 · Published 2026-11-11

weDevs ERP is a WordPress plugin that manages human resources functions including employee records and payroll. The plugin incorrectly validates permissions when employees edit their own profiles through AJAX requests, allowing any logged-in employee to change their job title, pay rate, reporting manager, and employment type without proper authorization. An attacker with employee access could fraudulently modify their compensation and role assignments.

Technologies: weDevs WP ERP. Vendors: weDevs.

Quick answers

Is CVE-2026-126808 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126808 being exploited in the wild.
How severe is CVE-2026-126808?: Medium severity, with a CVSS score of 4.3, published 11 November 2026.
Which products and versions are affected?: weDevs WP ERP through 1.17.11.
Is there a fix for CVE-2026-126808?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-126808 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126808?: Check whether you run weDevs WP ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HRM AJAX handlers check for the erp_edit_employee capability instead of the more restrictive erp_manage_jobinfo capability when processing profile updates. An authenticated employee can craft an AJAX request with the My Profile nonce, supplying their own user_id to modify restricted fields such as designation, reporting manager, pay rate, employment type, or delete job history records. The vulnerability requires authentication and a valid nonce but allows privilege escalation via self-service data modification.

Affected products

weDevs WP ERP through 1.17.11

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.