What is the CVSS score of CVE-2026-9237?

CVE-2026-9237 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Crew HRM CVE-2026-9237

EUVD-2026-42566 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-qjph-9jxc-9pcm

WordPress Authentication Bypass Wordpress Plugin Employee Leave And Recruitment Management System Crew Hrm

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-based attack requiring subscriber auth only; nonce leak removes AC complexity; impact confined to job listing integrity with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:56 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

MEDIUM 4.3

DescriptionCVE.org

The Employee, Leave and Recruitment Management System - Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings - along with their associated stages, meta, addresses, and applications - by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.

AnalysisAI

Authorization bypass in the Crew HRM WordPress plugin (all versions ≤ 1.2.2) allows any authenticated subscriber-level user to delete, archive, unarchive, and duplicate arbitrary job listings - including associated stages, metadata, addresses, and applications - by supplying an arbitrary integer job_id. The nonce that nominally gates these actions via Dispatcher::dispatch() is deliberately exposed to every authenticated frontend visitor through wp_head script localization, making the bypass trivially reproducible by any user with a WordPress account. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists; however, the nonce leak collapses the practical access barrier to subscriber level.

Technical ContextAI

The affected product is the 'Employee, Leave and Recruitment Management System - Crew HRM' WordPress plugin (CPE: cpe:2.3:a:crewhrm:employee,_leave_and_recruitment_management_system_-_crew_hrm:*:*:*:*:*:*:*:*), a human resources management suite covering job listings, recruitment pipelines, and employee leave. The root cause is CWE-862 (Missing Authorization): the plugin's request dispatcher (classes/Setup/Dispatcher.php, lines 123 and 139) performs nonce verification but omits a role or capability check before delegating to job management controller actions (classes/Controllers/JobManagement.php, lines 29 and 151). Compounding the issue, the nonce itself is injected into the page HTML for all authenticated users via wp_head script localization (classes/Models/User.php, line 73), meaning any logged-in visitor can trivially extract it and satisfy the nonce check without possessing any elevated WordPress capability. This conflates authentication (proving identity) with authorization (verifying permission), a classic CWE-862 pattern.

RemediationAI

Upstream fix available (patch changeset 3556031 on WordPress Plugin Trac); a specific released patched version number is not independently confirmed from the provided data - administrators should check the WordPress plugin repository for a version beyond 1.2.2 and upgrade immediately. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/be30e951-7c8d-4baf-9288-0d12dacc0dc2 should be consulted for confirmed fix version details. As a compensating control where immediate upgrade is not possible, restrict subscriber-level account registration to trusted users only and review whether the plugin's frontend job management features need to be accessible to non-HR roles. Disabling subscriber self-registration on affected WordPress sites reduces the attack surface but does not eliminate risk from existing low-privilege accounts. There is no known network-layer workaround given the attack originates from authenticated HTTP requests.