WordPress Plugin Vulnerabilities

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce < 1.17.6 - Missing Authorization

Description

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.17.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
erp
Fixed in 1.17.6

References

CVE
CVE-2026-59522
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1a6ba67d-d10d-4590-8398-26b29c044fb3

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
7eef6dbd-55f0-43c8-8218-401e6841ad12

Timeline

Publicly Published
2026-07-15 (about 11 days ago)
Added
2026-07-21 (about 4 days ago)
Last Updated
2026-07-21 (about 4 days ago)

Other

Published
Title
Published
2025-12-15
Title
Sailing < 4.4.6 - Missing Authorization
Published
2026-05-12
Title
Blog2Social: Social Media Auto Post & Scheduler < 8.9.1 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
Published
2022-07-11
Title
YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure
Published
2026-01-05
Title
Depicter < 4.7.0 - Missing Authorization to Unauthenticated Display Rule Updates
Published
2025-01-06
Title
Jupiter X Core < 4.8.6 - Missing Authorization to Authenticated Library Sync