Junglewise Threat Intelligence

CVE-2026-9237: Crew HRM WordPress plugin authorization bypass in Job Management

CVE-2026-9237 · Severity: medium · CVSS 4.3 · Published 2026-07-09

Executive brief

The Crew HRM plugin for WordPress, which manages employee recruitment and leave, contains a security flaw that allows low-level users to interfere with job listings. An attacker with a basic account can delete, archive, or duplicate job postings and their associated application data. This could lead to the loss of recruitment records and disruption of hiring operations.

Technical details

The Crew HRM plugin for WordPress (up to version 1.2.2) is vulnerable to a missing authorization check (CWE-862). The vulnerability exists because the plugin fails to verify user permissions before performing actions on job listings. While the `Dispatcher::dispatch()` function performs a nonce check, the required nonce is leaked to all authenticated users via `wp_head` script localization. Consequently, an authenticated attacker with subscriber-level privileges can obtain the nonce and supply an arbitrary `job_id` to delete, archive, unarchive, or duplicate job listings, including their stages, metadata, and applications.

Affected products

  • crewhrm Employee, Leave and Recruitment Management System – Crew HRM up to, and including, 1.2.2

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References