What the vulnerability does
01Description
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Explanation of Vulnerability in Simple Terms
02Summary
The ERP plugin for WooCommerce contains a SQL injection vulnerability in versions up to 1.17.4. An attacker with low-level user access can craft malicious input to execute arbitrary SQL queries against the site's database. This allows unauthorized reading of sensitive data such as customer information, financial records, and credentials. The vulnerability requires authentication but no user interaction.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the site's database, including customer records and financial information.
Potential impact on your site
04Site Impact
Customer data, financial records, and other sensitive information stored in the database can be exposed to authenticated attackers.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., subscriber or customer role) on the site.
Key dates
06Disclosure timeline
August 5, 2026
CVE published
August 5, 2026
Record updated
