CVE-2026-126808: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers

Published Nov 11, 2026

Updated

weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erpeditemployee instead of erpmanagejobinfo. Attackers can post their own userid with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.

Event History

Nov 11, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WP ERP employee account with the ability to use the My Profile functionality can exploit it. The attacker does not need administrator or HR-management authorization if they have the affected employee-edit capability and a valid My Profile nonce.

What data can an attacker change or remove?

An attacker can modify their own designation, reporting manager, pay rate, and employment type. They can also delete their own job-history records.

Are accounts other than the attacker's own account affected?

The described attack uses the attacker's own user_id and My Profile nonce to alter that employee's HR information. The provided information does not establish that an attacker can modify other employees' records.

How can I determine whether an installation is affected?

Installations running WP ERP through version 1.17.11 are affected. Review whether employee users can access My Profile and submit HRM job-information AJAX requests; affected handlers authorize with erp_edit_employee rather than erp_manage_jobinfo.

CVE-2026-126808: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers

Event History

Frequently Asked Questions

Who can exploit this issue?

What data can an attacker change or remove?

Are accounts other than the attacker's own account affected?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data can an attacker change or remove?

Are accounts other than the attacker's own account affected?

How can I determine whether an installation is affected?