Description
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| weDevs | ERP | ≤ 1.17.11 | — |
References
- https://github.com/wp-erp/wp-erp/issues/1691 issue-tracking
- https://github.com/wp-erp/wp-erp/pull/1693 issue-tracking patch
- https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0 patch
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225 technical-description
- https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263 technical-description
- VulnCheck Advisory: WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers third-party-advisory