CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8.
Explanation of Vulnerability in Simple Terms
WP ERP contains a SQL injection vulnerability in its database query handling. An attacker with high-level privileges can inject malicious SQL code to read sensitive data from the site's database. The vulnerability affects versions up to 1.12.8. Site administrators should update to a patched version immediately.
What an attacker can do
Read sensitive data from the site database, including user information and business records.
Potential impact on your site
Confidential HR, recruitment, and accounting data stored in WP ERP could be exposed to privileged insiders.
Conditions required to exploit
Attacker must have high-level admin or manager privileges on the WordPress site.
Key dates
External resources
Related vulnerabilities
