What the vulnerability does
01Description
The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the `hrp-fetch-employees` AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive employee information including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status.
Explanation of Vulnerability in Simple Terms
02Summary
Hr Press Lite versions up to 1.0.2 lack proper authorization checks, allowing authenticated users with low privileges to read sensitive data they should not access. An attacker with a standard user account can retrieve confidential information without additional interaction. The vulnerability affects the application's access control logic and does not require special network conditions.
What an attacker can do
03Attacker Capabilities
Read sensitive data belonging to other users or restricted areas of the site.
Potential impact on your site
04Site Impact
User data and confidential information may be exposed to any authenticated user, compromising privacy and trust.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
March 21, 2026
CVE published
April 8, 2026
Record updated
