CVE-2026-105191: WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. The affected AJAX action lacks a capability check, so low-privileged accounts can access data beyond their intended permissions.
What access does an attacker need?
The attacker needs a valid authenticated account on the WordPress site. No user interaction is required, and the attacker can enumerate record identifiers to retrieve stored before-and-after audit-log values.
What information may be exposed?
Stored audit-log values for record changes may be disclosed, including sensitive HR, CRM, and accounting data belonging to other users.
How can I determine whether my site is affected?
Sites using the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin at a version earlier than 1.17.11 are affected. Review whether untrusted or low-privileged authenticated users, such as Subscribers, can access the site.