WP ERP CVE-2026-96346

Requires an authenticated WordPress session with at least Author-level privileges (PR:H) on a site running the WP ERP plugin version 1.17.9 or earlier; the vulnerable SQL-injection code path must be reachable by that role. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N). Limiting factors: the Author privilege requirement excludes anonymous/subscriber attackers, so exposure is highest on multi-author sites, membership/community sites, or sites where Author accounts are granted to third parties; sites restricting Author-or-above accounts to fully trusted staff face materially lower risk.

This is a genuine but privilege-gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, 7.6 HIGH) describes a network-reachable, low-complexity SQL injection that requires high privileges (PR:H) - consistent with Patchstack's 'Author SQL Injection' framing, meaning an authenticated user holding at least the WordPress Author role. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the supplied data, so all signals point to no known or automated exploitation to date; the elevated CVSS is driven by CWE-89's high confidentiality impact and the scope change (S:C) rather than by ease of access. No SSVC decision data was provided. Net: a real, patchable priority for sites that grant Author accounts to untrusted or semi-trusted users, but not an emergency mass-exploitation scenario - the PR:H requirement substantially narrows the attacker population versus an unauthenticated flaw.

An attacker who already holds (or has phished/registered into) a WordPress Author-level account on a site running WP ERP <= 1.17.9 sends a crafted request to a vulnerable plugin endpoint, injecting SQL that the backend executes against the WordPress database. This lets them read sensitive data such as password hashes, HR/CRM records, and secrets stored by the ERP suite. No public exploit code was identified at time of analysis, and no user interaction is required beyond the attacker's own authenticated session.