The ERP: Complete HR, Accounting & CRM Suite plugin for WordPress contains a generic SQL Injection flaw in the 'orderby' parameter used across several HR modules. The absence of prepared statements allows an authenticated user with HR Manager-level or higher privileges to inject arbitrary SQL into existing queries. Attackers can append additional statements that read sensitive data from the database, effectively compromising confidentiality of employee and financial records. This SQL Injection weakness is categorized as CWE‑89.

Affected product is the WordPress plugin ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce, versions up to and including 1.17.5. The flaw exists in the LeaveRequestsListTable and related HR modules that accept the 'orderby' parameter. WordPress sites running any of these versions expose an authenticated attack surface to users assigned the erp_list_employee capability, which is granted to HR Manager and higher roles.

The CVSS score of 6.5 indicates a moderate severity. EPSS is < 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw requires authenticated access with HR Manager-level privileges, an attacker must first compromise or be granted such a role within the WordPress site. Once authenticated, the attacker can craft a malicious 'orderby' value to inject and execute additional SQL statements. If the plugin is left outdated, the risk remains moderate, but the exposed sensitive data elevates the impact for systems that rely on the HR and accounting modules.