What is the CVSS score of EUVD-2026-42539?

EUVD-2026-42539 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WP ERP EUVD-2026-42539

| CVE-2026-13011 MEDIUM

SQL Injection (CWE-89)

2026-07-09 Wordfence

GHSA-874f-wgfx-gr6c

WordPress SQLi Erp Wordpress Plugin Wedevs

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires authenticated HR Manager role (PR:L); read-only SQL injection path means no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:59 vuln.today

CVE Published

Jul 09, 2026 - 07:55 nvd

MEDIUM 6.5

DescriptionCVE.org

The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the erp_list_employee capability, which is granted to HR Manager-level users and above within the WP ERP plugin.

AnalysisAI

SQL Injection in WP ERP (wedevs) versions through 1.17.5 allows authenticated HR Manager-level users to exfiltrate arbitrary data from the WordPress database via the unsanitized orderby parameter in the leave management module. The flaw resides in functions-leave.php and LeaveRequestsListTable.php, where user-supplied sort parameters are interpolated directly into SQL queries without escaping or prepared statements. No public exploit code is confirmed and this CVE is not listed in the CISA KEV catalog, but the confidentiality impact is high given the plugin stores HR records, payroll data, and CRM contacts.

Technical ContextAI

The affected software is WP ERP by wedevs (CPE: cpe:2.3:a:wedevs:erp), a comprehensive HR, accounting, and CRM suite for WordPress. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands): the orderby URL parameter handled by the leave management subsystem is concatenated into SQL ORDER BY clauses without escaping or use of WordPress prepared statement APIs ($wpdb->prepare()). The vulnerable code paths are pinpointed by source references to modules/hrm/includes/functions-leave.php (lines 1408, 1409, 1521) and modules/hrm/includes/LeaveRequestsListTable.php (line 384). WordPress does not automatically sanitize ORDER BY values, placing full responsibility on plugin authors - a commonly missed sanitization surface.

RemediationAI

Update WP ERP to the latest available version beyond 1.17.5 via the WordPress plugin dashboard; a fix has been committed to the upstream SVN repository per the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/208c8f55-14e0-47c4-b310-dd7b7edbadd4) and the changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3598905%40erp&new=3598905%40erp), though the exact patched release version is not independently confirmed in the available input data - verify the installed version against the Wordfence advisory after updating. As a compensating control where immediate patching is not feasible, audit and minimize the set of users assigned the HR Manager role or the erp_list_employee capability, removing any accounts that do not strictly require it - this directly shrinks the exploitable attack surface. A WAF rule blocking SQL metacharacters (single quotes, UNION, comment sequences) in the orderby parameter on WP ERP leave management endpoints can provide additional layered defense, though this may require tuning to avoid false positives on legitimate sort requests.