What the vulnerability does
01Description
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_crm_contact functions. This makes it possible for unauthenticated attackers to modify the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The ERP plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions before 1.6.4. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires the admin to visit the attacker's page while authenticated to the WordPress site.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An admin's session can be hijacked to make unauthorized changes to site data or settings without their consent.
Conditions required to exploit
05Prerequisites
Site admin must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
06Disclosure timeline
July 1, 2023
CVE published
April 8, 2026
Record updated
