CVE-2025-5956: WP Human Resource Management Auth Bypass

CVE-2025-5956 Overview

CVE-2025-5956 is a missing authorization vulnerability [CWE-862] in the WP Human Resource Management plugin for WordPress, affecting versions 2.0.0 through 2.2.17. The plugin's ajax_delete_employee() function fails to verify that the caller holds the delete_users capability before invoking wp_delete_user() on attacker-supplied IDs. Authenticated users with Employee-level access or above can delete arbitrary accounts, including site administrators. The flaw enables full disruption of WordPress role hierarchies and site availability.

Critical Impact
Any authenticated user with Employee role or higher can delete arbitrary WordPress accounts — including administrators — leading to loss of integrity and availability across the affected site.

Affected Products

Mishubd WP Human Resource Management plugin for WordPress, versions 2.0.0 through 2.2.17
WordPress sites with the hrm plugin installed and active
Any site permitting Employee-level (or higher) authenticated access through the plugin

Discovery Timeline

2025-07-04 - CVE-2025-5956 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5956

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX deletion handler ajax_delete_employee() within class/employee.php. The handler reads the client-supplied $_POST['delete'] array and passes each value directly to WordPress's wp_delete_user() function. The code path performs no capability check and does not restrict which user IDs are eligible for deletion.

Because the AJAX action is accessible to any authenticated session at Employee privilege or above, the plugin trusts low-privileged callers to specify deletion targets. An attacker can iterate through user IDs and remove administrator accounts, service accounts, or any other user. The CWE-862 classification reflects the absence of an authorization gate before a privileged action.

The vulnerability affects only integrity and availability — confidentiality of stored data is not directly impacted by the deletion call, but downstream effects on site operations are substantial when administrative accounts are removed.

Root Cause

The root cause is the absence of a current_user_can('delete_users') capability check in ajax_delete_employee(). WordPress AJAX endpoints registered through wp_ajax_* hooks require explicit authorization logic; the plugin instead relies solely on the user being authenticated. Combined with the lack of an allow-list restricting deletable IDs to employee records, the handler exposes the full WordPress user table to deletion.

Attack Vector

An attacker authenticates with any account holding Employee-level access or higher. The attacker then submits a POST request to the plugin's AJAX endpoint with a delete parameter containing target user IDs. The server invokes wp_delete_user() for each ID without authorization checks, removing the target accounts and reassigning or destroying their content per WordPress defaults.

The vulnerability requires network access to the WordPress admin-ajax endpoint and a valid low-privileged session. No user interaction from the victim is required. Refer to the WordPress Plugin Code Review for the affected function source.

Detection Methods for CVE-2025-5956

Indicators of Compromise

Unexpected wp_users table deletions or sudden disappearance of administrator accounts
POST requests to admin-ajax.php containing the plugin's delete action and a delete[] parameter from low-privileged sessions
WordPress audit log entries showing wp_delete_user() invocations originating from Employee-role sessions
Loss of access to wp-admin for previously valid administrator accounts

Detection Strategies

Review WordPress access logs for POST requests to admin-ajax.php referencing the hrm plugin's delete employee action correlated with non-admin authenticated sessions
Enable WordPress user activity auditing to capture deletion events with originating user ID and IP address
Compare current wp_users row counts against baseline backups to identify unauthorized removals

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM and alert on user deletion events tied to non-administrative roles
Monitor for bursts of admin-ajax.php requests carrying delete[] arrays
Track administrator account counts and trigger alerts on any decrease

How to Mitigate CVE-2025-5956

Immediate Actions Required

Update the WP Human Resource Management plugin to a version newer than 2.2.17 once the vendor publishes a fix
Audit Employee-role and higher accounts and disable any that are not strictly required
Restore any deleted administrator accounts from backup and rotate credentials
Restrict access to admin-ajax.php from untrusted networks where feasible

Patch Information

At the time of NVD publication, all versions from 2.0.0 through 2.2.17 are affected. Site operators should monitor the WordPress Plugin Developer Info page and the Wordfence Vulnerability Report for patched release information.

Workarounds

Deactivate the WP Human Resource Management plugin until a patched version is available
Apply a web application firewall rule blocking requests to admin-ajax.php that invoke the plugin's delete employee action from non-administrator sessions
Restrict Employee-role assignment to fully trusted users only and revoke unnecessary access

bash

# Example WAF rule concept: block delete_employee AJAX action for non-admins
# (Adapt to your WAF syntax — ModSecurity, Cloudflare, etc.)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1005956,msg:'Block HRM ajax_delete_employee'"
  SecRule ARGS:action "@streq hrm_delete_employee"