The Hr Press Lite plugin for WordPress contains a missing capability check on the hrp-fetch-employees AJAX action. As a result, any authenticated user with Subscriber-level access or higher can trigger the action and retrieve sensitive employee data, including names, email addresses, phone numbers, salary or pay rate, employment dates, and employment status. This flaw leads to unauthorized disclosure of personally identifiable and financial information, violating confidentiality and potentially enabling further exploitation. The vulnerability is classified as CWE-862, a missing authorization flaw.

The affected product is the Hr Press Lite WordPress plugin, codeclove:Hr Press Lite. All releases up to and including version 1.0.2 contain the flaw. WordPress sites that have installed any of these versions are vulnerable, regardless of the WordPress core version or other plugins. Administrators should verify the plugin version and update to the latest release once available.

The CVSS score is 6.5, indicating a medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw permits data exposure through an authenticated AJAX endpoint, any user with login credentials at the Subscriber tier can exploit it without additional prerequisites. Attackers can cheaply obtain sensitive employee information over the network by simply sending a request to the exposed AJAX handler. The overall risk is moderate, but the impact on privacy and compliance makes timely remediation critical.