EUVD-2026-53041
GHSA-hjjr-7h7r-m538
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L reflects mandatory CRM Agent role; AV:N for network-accessible AJAX endpoint; C:H for arbitrary database read; I:N and A:N as the injection path is read-only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the WP ERP WordPress plugin (all versions through 1.17.4) allows authenticated CRM Agent-role users to extract arbitrary data from the WordPress database by supplying a crafted 'erpadvancefilter' parameter to the CRM AJAX handler. The root flaw is a sanitization gap: sanitize_text_field strips HTML but preserves single quotes, which are then interpolated verbatim into a single-quoted SQL WHERE clause inside erp_crm_contact_advance_filter() before execution via $wpdb->get_results(), bypassing WordPress's parameterized query protections entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress session authenticated with the plugin-supplied CRM Agent role or a higher CRM role (CRM Manager or WordPress admin), plus the erp_crm_list_contact capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD/Wordfence CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the primary risk profile: the attack requires no special network position and low complexity, but is gated behind a low-privilege authenticated session with the plugin-supplied CRM Agent role and the erp_crm_list_contact capability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A fix has been committed to the plugin's development trunk in changeset 3577284, modifying functions-customer.php to address the interpolation flaw; however, a tagged released version beyond 1.17.4 is not independently confirmed from the available references, so administrators should monitor the WordPress plugin repository at https://wordpress.org/plugins/erp/ for a patched release and upgrade promptly once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/co
An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a c
jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php. Rate
Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability. Rated high severity (CVSS
Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMSer
A vulnerability was found in jerryhanjj ERP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/in
Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint.
Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceSe
Unrestricted file upload in the wedevs WP ERP plugin (ERP: Complete HR, Accounting & CRM Suite for WooCommerce) for Word
There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php file
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today