Privilege Escalation in WP Human Resource Management Plugin by WordPress

CVE-2025-5953

What is CVE-2025-5953?

The WP Human Resource Management plugin for WordPress is susceptible to a privilege escalation vulnerability caused by inadequate authorization checks in the ajax_insert_employee() and update_employee() functions. Specifically, an attacker with Employee-level access could exploit the AJAX handler to assign themselves higher user roles, such as Administrator, without proper permissions. This vulnerability underscores the importance of thorough authorization checks when handling user roles within an application.

References