Data Exposure in ERP: Complete HR, Accounting & CRM Suite for WooCommerce
CVE-2026-105191

Currently unrated

Key Information:

Vendor

WordPress
Status
Erp: Complete Hr, Accounting & Crm Suite Built For WooCommerce
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105191?

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin prior to version 1.17.11 contains a security flaw that fails to properly check user capabilities during a specific AJAX action. This oversight permits any authenticated user, even those with minimal permissions like Subscribers, to access and retrieve sensitive data concerning other users' HR, CRM, and Accounting records by exploiting record change identifiers. As a result, important personal information may become exposed, leading to potential privacy violations and data misuse.

Affected Version(s)

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce 0 < 1.17.11

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105191 - Proof of Concept

References

https://wpscan.com/vulnerability/e9d5db8d-5eac-404e-ac29-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

cyberkareem
WPScan
.