CVE-2026-105191

Full vulnerability record from the local CVENow database.

Description

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 06:16:57.320000

Last modified

2026-11-04 06:16:57.320000

View original CVE JSON

{
  "id": "CVE-2026-105191",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T06:16:57.320",
  "lastModified": "2026-11-04T06:16:57.320",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.17.11",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/e9d5db8d-5eac-404e-ac29-847689af0d53/",
      "source": "[email protected]"
    }
  ]
}