Description
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2026-08-05
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress suffers from a SQL Injection flaw enabled by the 'erpadvancefilter' parameter. An attacker who can authenticate as a CRM Agent, CRM Manager or WordPress administrator can craft inputs that are not properly escaped and are directly interpolated into a quoted SQL WHERE clause. This leads to the execution of arbitrary SQL that can read sensitive database content, such as personal records. The weakness is a classic example of CWE‑89, where user supplied data is injected into an SQL statement without adequate sanitisation.

Affected Systems

Affected systems are WordPress sites running the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin version 1.17.4 or earlier, including all releases up to and including 1.17.4. The vulnerability is present in all WordPress‑driven deployments of this plugin that grant CRM Agent or higher roles with the erp_crm_list_contact capability. The plugin identifier is wedevs:ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce.

Risk and Exploitability

The CVSS score for this flaw is 6.5, reflecting a moderate severity. Because the exploitation requires valid credentials and specific capabilities, the likelihood of a successful attack in the wild is limited, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. Defenders should consider that an authenticated attacker could conduct data theft or pivot to wider system compromise if credentials are compromised. Prompt remediation reduces the risk of undetected data exfiltration.

Generated by OpenCVE AI on August 5, 2026 at 06:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the ERP plugin to a version that has addressed the SQL injection issue, preferably the latest release available from the vendor.
  • Review and tighten role capabilities: ensure only trusted users are assigned the CRM Agent role and that the erp_crm_list_contact capability is limited to necessary personnel.
  • If an upgrade cannot be performed immediately, modify the plugin by applying a custom function to sanitize the 'erpadvancefilter' input—removing or escaping single quotes—before it is added to the SQL query, or disable the feature that triggers the vulnerable code path.
  • Audit database access controls and monitor for anomalous query activity following any detected intrusion.

Generated by OpenCVE AI on August 5, 2026 at 06:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Wedevs
Wedevs erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products Wedevs
Wedevs erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce
Wordpress
Wordpress wordpress

Wed, 05 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Description The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wedevs Erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-05T13:41:17.394Z

Reserved: 2026-06-05T20:00:22.404Z

Link: CVE-2026-11421

cve-icon Vulnrichment

Updated: 2026-08-05T13:41:12.630Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T06:30:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')