Skip to main content

WP ERP EUVDEUVD-2026-45133

| CVE-2026-15349 MEDIUM
Missing Authorization (CWE-862)
2026-07-17 Wordfence GHSA-3jxm-6h46-j67p
WordPress Authentication Bypass Erp
4.3
CVSS 3.1 · Vendor: Wordfence
Share

Severity by source

Vendor (Wordfence) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
4.3 MEDIUM

Network-reachable AJAX endpoint requires only subscriber authentication (PR:L); no confidentiality or availability impact from location record creation alone.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 17, 2026 - 05:15 vuln.today
CVE Published
Jul 17, 2026 - 03:43 cve.org
MEDIUM 4.3

DescriptionCVE.org

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.

AnalysisAI

Authorization bypass in the WP ERP WordPress plugin (versions through 1.17.6) allows authenticated attackers with subscriber-level access to create arbitrary company locations in the ERP database. The flaw stems from a missing authorization check in the plugin's Admin AJAX handler, as identified by Wordfence and corroborated by source code references at includes/Admin/Ajax.php. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Register or obtain WordPress subscriber account
Delivery
Authenticate to WordPress site
Exploit
Craft AJAX POST to admin-ajax.php with location-creation action
Execution
Bypass missing authorization check in Ajax.php
Impact
Insert arbitrary company location record into ERP database
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid WordPress user account at subscriber level or above - the lowest non-anonymous role in WordPress, obtainable by self-registration on sites with open user registration enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained impact: exploitation is network-accessible and requires no user interaction, but demands at minimum subscriber-level authentication (PR:L), and the integrity impact is limited to creating ERP location records - no confidentiality exposure and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a free subscriber account on a WordPress site running WP ERP with open user registration enabled. The attacker then sends a crafted authenticated AJAX POST request directly to wp-admin/admin-ajax.php targeting the unprotected location-creation action, supplying arbitrary location data. …
Remediation A fix has been committed to the plugin repository as changeset 3609754 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3609754%40erp&new=3609754%40erp); however, the exact patched release version number is not independently confirmed from the available data - site administrators should update to the latest available version of the WP ERP plugin via the WordPress admin dashboard and verify that the installed version exceeds 1.17.6. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Erp

View all
CVE-2024-42565 CRITICAL POC
9.8 Aug 20

ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/co
CVE-2024-42563 CRITICAL POC
9.8 Aug 20

An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a c
CVE-2025-29390 HIGH POC
8.8 Apr 09

jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php. Rate
CVE-2023-26762 HIGH POC
8.8 Feb 27

Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability. Rated high severity (CVSS
CVE-2023-26759 HIGH POC
8.8 Feb 27

Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMSer
CVE-2022-3944 HIGH POC
8.8 Nov 11

A vulnerability was found in jerryhanjj ERP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
CVE-2024-42564 HIGH POC
7.6 Aug 20

ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/in
CVE-2023-26760 HIGH POC
7.5 Feb 27

Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint.

CVE-2023-26758 HIGH POC
7.5 Feb 27

Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceSe
CVE-2020-8967 CRITICAL
9.8 Jun 01

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php file
CVE-2020-6188 HIGH
8.8 Feb 12

VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700,
CVE-2026-13011 MEDIUM
6.5 Jul 09

SQL Injection in WP ERP (wedevs) versions through 1.17.5 allows authenticated HR Manager-level users to exfiltrate arbit

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-45133 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy