Executive brief
The ERP plugin for WordPress, which manages business functions like HR and accounting, contains a security flaw that allows low-level users to bypass authorization checks. An attacker with a basic account (such as a subscriber) can create unauthorized company locations within the system's database. This could lead to data integrity issues and unauthorized changes to organizational records.
Technical details
The vulnerability is classified as a Missing Authorization (CWE-862) flaw within the ERP plugin for WordPress. It resides in the plugin's handling of administrative or AJAX actions, specifically within components like AdminPage.php and Ajax.php, where the software fails to perform adequate capability checks. An authenticated attacker with at least Subscriber-level permissions can exploit this by sending crafted requests to create new company locations in the database. The issue is present in all versions up to 1.17.6; users should update to a patched version if available.
Affected products
- weDevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory
References
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.5/includes/Admin/AdminPage.php
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.5/includes/Admin/Ajax.php
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.5/includes/Admin/Ajax.php
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.5/includes/Admin/views/address.php
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.6/includes/Admin/AdminPage.php
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.6/includes/Admin/Ajax.php
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.6/includes/Admin/Ajax.php