# CVE-2026-126808: weDevs ERP authorization bypass in employee profile editing

Source: https://junglewise.ai/threats/cve-2026-126808-wedevs-erp-wp-erp-through-1-17-11-contains-an-incorrect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126808 · Severity: medium · CVSS 4.3 · Published 2026-11-11

weDevs ERP is a WordPress plugin that manages human resources functions including employee records and payroll. The plugin incorrectly validates permissions when employees edit their own profiles through AJAX requests, allowing any logged-in employee to change their job title, pay rate, reporting manager, and employment type without proper authorization. An attacker with employee access could fraudulently modify their compensation and role assignments.

Technologies: [weDevs WP ERP](https://junglewise.ai/threats/technologies/wp-erp). Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-126808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126808 being exploited in the wild.

**How severe is CVE-2026-126808?** Medium severity, with a CVSS score of 4.3, published 11 November 2026.

**Which products and versions are affected?** weDevs WP ERP through 1.17.11.

**Is there a fix for CVE-2026-126808?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126808 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126808?** Check whether you run weDevs WP ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HRM AJAX handlers check for the erp_edit_employee capability instead of the more restrictive erp_manage_jobinfo capability when processing profile updates. An authenticated employee can craft an AJAX request with the My Profile nonce, supplying their own user_id to modify restricted fields such as designation, reporting manager, pay rate, employment type, or delete job history records. The vulnerability requires authentication and a valid nonce but allows privilege escalation via self-service data modification.

## Affected products

- weDevs WP ERP through 1.17.11

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php](https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php)
- [https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php](https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php)

## Related threats

- [weDevs WP ERP broken access control vulnerability](https://junglewise.ai/threats/cve-2026-25448-missing-authorization-vulnerability-in-wedevs-wp-erp-erp-allows)
- [weDevs WP ERP broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-59522-wedevs-wp-erp-broken-access-control-in-wordpress-plugin)
- [weDevs WP ERP SQL injection in orderby parameter](https://junglewise.ai/threats/cve-2026-13011-wedevs-wp-erp-sql-injection-in-orderby-parameter)