What is the CVSS score of CVE-2026-59522?

CVE-2026-59522 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WP ERP CVE-2026-59522

Q: Which versions of WP ERP are affected by CVE-2026-59522?

Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view.

EUVD-2026-48189 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-h3rm-q8jf-8q94

WordPress Authentication Bypass Wp Erp Wordpress Plugin Wedevs

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L is correct for subscriber-tier requirement; AV:N because exploitation is over the network via HTTP; C:H reflects ERP data sensitivity; I:N and A:N because the flaw grants read-only unauthorized access with no write or disruptive capability confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:07 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

AnalysisAI

Broken access control in WP ERP plugin (versions 1.17.5 and below) allows subscriber-level WordPress users to access sensitive ERP data they are not authorized to view. The CVSS vector confirms PR:L - a valid authenticated session at the subscriber tier is sufficient - and C:H indicates the exposed data carries high confidentiality value, consistent with ERP payloads such as HR records, financial data, and customer information. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

WP ERP (CPE: cpe:2.3:a:wedevs:wp_erp:*:*:*:*:*:*:*:*) is a WordPress plugin by weDevs that implements enterprise resource planning functions - HR management, accounting, and CRM - directly within a WordPress installation. CWE-862 (Missing Authorization) identifies the root cause: one or more plugin endpoints or REST API actions perform no capability check, or check for the wrong capability, before returning privileged ERP data to the requesting user. In WordPress's role hierarchy, 'subscriber' is the lowest authenticated role; users at this tier should have no access to ERP business records. The absence of a server-side authorization gate allows any authenticated session token - regardless of role - to retrieve data scoped to higher-privileged roles.

RemediationAI

Update WP ERP to a version released after 1.17.5; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/erp/vulnerability/wordpress-wp-erp-plugin-1-17-5-broken-access-control-vulnerability should be consulted for the exact fixed release once confirmed by the vendor. No patch version beyond 1.17.5 is independently confirmed from the available data - verify the current release in the WordPress plugin repository before upgrading. As a compensating control pending upgrade, disable subscriber self-registration on the WordPress site (Settings → General → uncheck 'Anyone can register') to prevent unauthenticated actors from obtaining the required low-privilege credential; note this will block legitimate subscriber signups as a side effect. Additionally, restrict ERP plugin access to known trusted roles via a capability management plugin, and audit existing subscriber accounts for unauthorized registrations.