Incorrect Authorization Vulnerability in weDevs ERP by WP ERP

CVE-2026-126808

What is CVE-2026-126808?

An incorrect authorization vulnerability exists in weDevs ERP (WP ERP) version 1.17.11. This flaw allows authenticated employees to manipulate their own HR records. Specifically, the HRM AJAX handlers utilize the erp_edit_employee check instead of the more restrictive erp_manage_jobinfo check. This loophole enables attackers to submit their own user_id along with the My Profile nonce, granting them the ability to alter sensitive details such as designation, reporting manager, pay rate, and employment type, or to even erase their job history.

References