Arbitrary User Deletion Vulnerability in WP Human Resource Management Plugin by WordPress

CVE-2025-5956

What is CVE-2025-5956?

The WP Human Resource Management plugin suffers from a significant vulnerability that allows authenticated users, with Employee-level access or higher, to delete any user account, including administrators. This occurs due to insufficient authorization checks in the ajax_delete_employee() function, where user IDs supplied through the $_POST['delete'] array are directly passed to the wp_delete_user() function without proper validation of the caller's permissions. This vulnerability can lead to unauthorized modification or deletion of user accounts, posing a substantial risk to site security.

References