CVE-2026-25448: WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability
Published Oct 29, 2026
·Updated
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP ERP pluginto a version that resolves this vulnerability.Fixed in 1.17.11
Event History
Oct 29, 2026
CVE Published
via MITRE·02:55 PM
Data Sourced
via MITRE·02:55 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be considered affected?
WP ERP installations are affected through version 1.17.10. The affected version range begins at an unspecified earlier version.
2
What level of access would an attacker need?
The CVSS vector indicates the issue is remotely exploitable with low attack complexity, requires low privileges, and does not require user interaction. Its stated impact is limited to confidentiality.