EUVD-2026-14161
GHSA-wcm8-f742-j3xh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive employee information including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status.
AnalysisAI
The Hr Press Lite WordPress plugin (versions up to 1.0.2) contains a missing capability check vulnerability in the hrp-fetch-employees AJAX action that allows authenticated attackers with Subscriber-level access to retrieve sensitive employee information including names, email addresses, phone numbers, salary data, employment dates, and employment status. This represents a clear privilege escalation and information disclosure flaw with a CVSS score of 6.5 (Medium severity, high confidentiality impact) affecting all versions of the plugin distributed through the WordPress plugin repository.
Technical ContextAI
The vulnerability exists in the WordPress plugin architecture where AJAX actions are registered without proper capability verification. Specifically, the hrp-fetch-employees AJAX handler in Hr Press Lite (as evidenced by the code references in HRP_Action.php line 1444) fails to implement WordPress capability checks (such as current_user_can() with appropriate administrative capabilities) before returning employee data. This falls under CWE-862 (Missing Authorization), a common authorization bypass pattern in WordPress plugin development. The vulnerability affects the plugin identified via CPE cpe:2.3:a:codeclove:hr_press_lite:*:*:*:*:*:*:*:*, indicating all versions across all patch levels are potentially impacted. The root cause is the absence of nonce verification and role-based access control on a sensitive AJAX endpoint that should be restricted to HR administrators only.
RemediationAI
Update Hr Press Lite to a patched version beyond 1.0.2 as provided by the plugin author CodeClove through the WordPress plugin repository. If an update is not immediately available, disable the Hr Press Lite plugin entirely until a patch is released. As a temporary workaround, restrict plugin access by limiting user roles (do not grant Subscriber role to untrusted users) and consider using Web Application Firewall rules to block requests to the hrp-fetch-employees AJAX action if the plugin must remain active. Verify through the WordPress plugin repository and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a63b8e-e16e-4702-be1b-acc5c3e74b22 for the latest patch status and release notes.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today