SQL Injection Vulnerability in ERP: Complete HR, Accounting & CRM Suite Plugin for WordPress

CVE-2026-13011

What is CVE-2026-13011?

The ERP: Complete HR, Accounting & CRM Suite plugin for WordPress has a vulnerability that arises from insufficient input sanitization on the 'orderby' parameter. This flaw allows authenticated users with HR Manager-level access or higher to inject malicious SQL queries into existing database queries. By exploiting this weakness, attackers can potentially retrieve sensitive information stored in the database, posing a significant risk to data integrity and confidentiality. The lack of preparation in handling user-supplied input amplifies the threat, necessitating immediate attention and remedial action to safeguard user data.

References