Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ERP by weDevs
CVE-2026-126808 (GCVE-0-2026-126808)
Vulnerability from nvd – Published: 2026-11-11 20:53 – Updated: 2026-11-11 20:53
VLAI
EPSS
VEX
Title
WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
Summary
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/wp-erp/wp-erp/issues/1691 | issue-tracking |
| https://github.com/wp-erp/wp-erp/pull/1693 | issue-trackingpatch |
| https://github.com/wp-erp/wp-erp/commit/54666918b… | patch |
| https://github.com/wp-erp/wp-erp/blob/v1.17.11/mo… | technical-description |
| https://github.com/wp-erp/wp-erp/blob/v1.17.11/mo… | technical-description |
| https://www.vulncheck.com/advisories/wp-erp-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-07 04:06
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wp-erp/wp-erp",
"product": "ERP",
"vendor": "weDevs",
"versions": [
{
"lessThanOrEqual": "1.17.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jerryhanjj:erp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-07T04:06:09.000Z",
"descriptions": [
{
"lang": "en",
"value": "weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T20:53:10.317Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/wp-erp/wp-erp/issues/1691"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/wp-erp/wp-erp/pull/1693"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263"
},
{
"name": "VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers"
}
],
"title": "WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126808",
"datePublished": "2026-11-11T20:53:10.317Z",
"dateReserved": "2026-11-11T20:01:50.746Z",
"dateUpdated": "2026-11-11T20:53:10.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126808 (GCVE-0-2026-126808)
Vulnerability from cvelistv5 – Published: 2026-11-11 20:53 – Updated: 2026-11-11 20:53
VLAI
EPSS
VEX
Title
WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
Summary
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/wp-erp/wp-erp/issues/1691 | issue-tracking |
| https://github.com/wp-erp/wp-erp/pull/1693 | issue-trackingpatch |
| https://github.com/wp-erp/wp-erp/commit/54666918b… | patch |
| https://github.com/wp-erp/wp-erp/blob/v1.17.11/mo… | technical-description |
| https://github.com/wp-erp/wp-erp/blob/v1.17.11/mo… | technical-description |
| https://www.vulncheck.com/advisories/wp-erp-throu… | third-party-advisory |
Impacted products
Date Public
2026-11-07 04:06
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wp-erp/wp-erp",
"product": "ERP",
"vendor": "weDevs",
"versions": [
{
"lessThanOrEqual": "1.17.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jerryhanjj:erp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-07T04:06:09.000Z",
"descriptions": [
{
"lang": "en",
"value": "weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T20:53:10.317Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/wp-erp/wp-erp/issues/1691"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/wp-erp/wp-erp/pull/1693"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263"
},
{
"name": "VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers"
}
],
"title": "WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126808",
"datePublished": "2026-11-11T20:53:10.317Z",
"dateReserved": "2026-11-11T20:01:50.746Z",
"dateUpdated": "2026-11-11T20:53:10.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}