CVE-2026-96343: WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
Published Sep 30, 2026
·Updated
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Affected Software
1 affected component
weDevs WP ERP<=1.17.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP ERP pluginto a version that resolves this vulnerability.Fixed in 1.17.10
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges. An attacker must already have a high-privilege account or equivalent access in the affected WordPress environment.
2
Can this be exploited remotely without user interaction?
Yes. The vector is network-based, the attack complexity is low, and no user interaction is required. However, exploitation still requires high privileges.
3
What impact could successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at a high level, according to the supplied CVSS metrics.