Description
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Published: 2026-11-11
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
Description weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Title WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
First Time appeared Jerryhanjj
Jerryhanjj erp
Weaknesses CWE-863
CPEs cpe:2.3:a:jerryhanjj:erp:*:*:*:*:*:*:*:*
Vendors & Products Jerryhanjj
Jerryhanjj erp
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Jerryhanjj Erp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-11T20:53:10.317Z

Reserved: 2026-11-11T20:01:50.746Z

Link: CVE-2026-126808

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T21:16:44.963

Modified: 2026-11-11T21:16:44.963

Link: CVE-2026-126808

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses