What is the CVSS score of CVE-2026-15349?

CVE-2026-15349 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

WP ERP CVE-2026-15349

EUVD-2026-45133 MEDIUM

Missing Authorization (CWE-862)

2026-07-17 Wordfence

GHSA-3jxm-6h46-j67p

WordPress Authentication Bypass Erp Wordpress Plugin Wedevs

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable AJAX endpoint requires only subscriber authentication (PR:L); no confidentiality or availability impact from location record creation alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 05:15 vuln.today

CVE Published

Jul 17, 2026 - 03:43 cve.org

MEDIUM 4.3

DescriptionCVE.org

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.

AnalysisAI

Authorization bypass in the WP ERP WordPress plugin (versions through 1.17.6) allows authenticated attackers with subscriber-level access to create arbitrary company locations in the ERP database. The flaw stems from a missing authorization check in the plugin's Admin AJAX handler, as identified by Wordfence and corroborated by source code references at includes/Admin/Ajax.php. No public exploit code or CISA KEV listing exists at time of analysis, but the low privilege bar (any registered WordPress user) on a network-accessible endpoint makes opportunistic abuse straightforward on sites with open user registration.

Technical ContextAI

The affected product is the weDevs ERP plugin for WordPress (CPE: cpe:2.3:a:wedevs:erp:_complete_hr,_accounting_&_crm_suite_built_for_woocommerce), a comprehensive HR, Accounting, and CRM suite that integrates with WooCommerce. The root cause is CWE-862 (Missing Authorization): the WordPress AJAX handler registered in includes/Admin/Ajax.php does not perform a capability check to confirm the requesting user is authorized to perform company location management actions before executing the database write. WordPress subscriber-level users have minimal permissions by design (read-only front-end access), yet the plugin fails to enforce that boundary on this action. The source code references at Ajax.php lines 23 and 516 across both 1.17.5 and 1.17.6 tag snapshots confirm the vulnerable code paths remained unchanged between those two releases.

RemediationAI

A fix has been committed to the plugin repository as changeset 3609754 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3609754%40erp&new=3609754%40erp); however, the exact patched release version number is not independently confirmed from the available data - site administrators should update to the latest available version of the WP ERP plugin via the WordPress admin dashboard and verify that the installed version exceeds 1.17.6. As a compensating control pending update, administrators can restrict WordPress user registration to prevent untrusted subscribers from obtaining the minimum required access level: navigate to Settings > General and uncheck 'Anyone can register'. This eliminates the exploitable population on public-facing sites but may affect legitimate onboarding workflows. Role-based access plugins such as Members or User Role Editor can also be used to further restrict AJAX endpoint access by capability.