WP ERP CVE-2026-11421

Exploitation requires a valid WordPress session authenticated with the plugin-supplied CRM Agent role or a higher CRM role (CRM Manager or WordPress admin), plus the erp_crm_list_contact capability. These roles must be explicitly assigned by a WordPress administrator - they are not granted by default to ordinary subscribers or site visitors. The vulnerable code path is reached via a network-accessible AJAX endpoint (AV:N, no local access required), but the session authentication gate means unauthenticated attackers cannot reach the vulnerable parameter. Exploitation is further limited to WordPress installations with the WP ERP plugin active and its CRM module enabled. What limits exploitation: the requirement for a specifically privileged, plugin-assigned role reduces the realistic attacker pool to insiders, compromised privileged accounts, or social-engineering scenarios targeting CRM users.

The NVD/Wordfence CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the primary risk profile: the attack requires no special network position and low complexity, but is gated behind a low-privilege authenticated session with the plugin-supplied CRM Agent role and the erp_crm_list_contact capability. This authentication requirement is the single most significant real-world mitigating factor - an attacker must first obtain valid credentials with that specific role, which requires prior admin assignment. Confidentiality impact is high (arbitrary database read, potentially exposing WordPress user hashes, contact PII, financial data), while integrity and availability are unaffected by this injection path. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit or POC has been identified. The Wordfence advisory and detailed trac source links make the flaw technically transparent, which may lower the barrier to exploitation once a POC is developed. Real-world priority is moderate: organizations with many CRM Agent role users face meaningful insider or compromised-credential risk; organizations with tightly controlled role assignments face lower immediate exposure.

An attacker who has obtained or been granted a CRM Agent account on the target WordPress site submits a crafted HTTP request to the CRM AJAX endpoint with a malicious 'erpadvancefilter' value containing a SQL escape sequence (e.g., a single quote followed by a UNION SELECT clause). Because sanitize_text_field preserves the single quote, the injected SQL breaks out of the intended WHERE clause string and appends an attacker-controlled query, causing $wpdb->get_results() to return rows from arbitrary database tables including wp_users. No public POC has been identified, but the full call chain is documented in Wordfence's advisory and the plugin trac source references.