CVE-2026-11421: WordPress ERP Plugin SQLi Vulnerability

CVE-2026-11421 Overview

CVE-2026-11421 is a SQL injection vulnerability in the ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress. The flaw affects all versions up to and including 1.17.4. The vulnerability exists in the erpadvancefilter parameter, where user input is passed through sanitize_text_field and then interpolated directly into a single-quoted SQL WHERE clause. Authenticated users holding the plugin-supplied CRM Agent role or higher, with the erp_crm_list_contact capability, can append arbitrary SQL to the query. Successful exploitation enables extraction of sensitive database contents.

Critical Impact
Authenticated CRM users can execute injected SQL queries to exfiltrate confidential data from the WordPress database, including customer records and credentials.

Affected Products

ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress
All versions up to and including 1.17.4
WordPress installations exposing the CRM contact filter AJAX handler

Discovery Timeline

2026-08-05 - CVE-2026-11421 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-11421

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the CRM contact filtering workflow. The AJAX handler in modules/crm/includes/AjaxHandler.php accepts the erpadvancefilter parameter from authenticated requests. That value is sanitized only with sanitize_text_field, which normalizes whitespace and strips tags but preserves single quotes and SQL metacharacters. The downstream function erp_crm_contact_advance_filter() in modules/crm/includes/functions-customer.php concatenates the filter value directly into a SQL WHERE clause before executing it via $wpdb->get_results(). Because the query is not built with prepared statements or $wpdb->prepare(), attackers can break out of the single-quoted context and append additional SQL. The network attack vector requires only low-privilege authentication and no user interaction, but exposure is limited to confidentiality.

Root Cause

The root cause is the reliance on sanitize_text_field as a security control against SQL injection. The function is intended for cleaning display text, not for escaping SQL. Combined with string interpolation into a SQL query, this produces an unbounded injection sink at the $wpdb->get_results() call site.

Attack Vector

An attacker authenticates to WordPress with an account granted the CRM Agent role or higher, such as CRM Manager or administrator, which conveys the erp_crm_list_contact capability. The attacker submits a crafted erpadvancefilter payload to the CRM contact filter AJAX endpoint. The injected fragment closes the existing single-quoted literal and appends a UNION SELECT or subquery to read arbitrary tables, including wp_users password hashes and session tokens.

See the Wordfence Vulnerability Report and the vulnerable AjaxHandler code for technical details on the sink.

Detection Methods for CVE-2026-11421

Indicators of Compromise

POST requests to admin-ajax.php with action=erp-crm-contact-filter-save or related CRM contact filter actions containing SQL metacharacters in the erpadvancefilter parameter.
Unusual UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or comment sequences (--, #, /*) inside erpadvancefilter request bodies.
Web server logs showing authenticated CRM Agent sessions issuing repeated filter requests within short time windows.
Database error entries referencing erp_crm_contact_advance_filter or malformed WHERE clauses.

Detection Strategies

Inspect WordPress access logs for admin-ajax.php requests where the erpadvancefilter parameter contains single quotes, parentheses, or SQL keywords.
Enable MySQL general query logging temporarily on staging instances to identify anomalous WHERE fragments produced by the CRM module.
Deploy a web application firewall (WAF) rule that blocks SQL syntax in erpadvancefilter values submitted to the ERP plugin.

Monitoring Recommendations

Alert on any CRM Agent or CRM Manager account that queries a volume of contact records inconsistent with baseline behavior.
Monitor for creation of low-privilege CRM users followed by immediate filter-related AJAX activity.
Track outbound data volumes from the WordPress host to detect bulk exfiltration following filter abuse.

How to Mitigate CVE-2026-11421

Immediate Actions Required

Update the ERP plugin to a version later than 1.17.4 once the vendor publishes a fix. Track the WordPress ERP change log for the patched revision.
Audit all WordPress accounts assigned the CRM Agent, CRM Manager, or administrator roles and remove any unnecessary access.
Rotate WordPress user password hashes and API keys if exploitation is suspected.

Patch Information

The vendor changeset referenced in the advisory modifies modules/crm/includes/functions-customer.php to address the unsafe query construction. Administrators should install the fixed release from the WordPress plugin repository as soon as it is available and verify the version in wp-admin shows a release higher than 1.17.4.

Workarounds

Restrict access to the ERP CRM module by removing the erp_crm_list_contact capability from non-essential roles until the patch is applied.
Deploy a WAF signature blocking SQL metacharacters in the erpadvancefilter parameter on requests to admin-ajax.php.
Disable the ERP plugin on production sites that do not actively require the CRM contact filtering feature.

bash

# Example WAF rule (ModSecurity) blocking SQL syntax in erpadvancefilter
SecRule ARGS:erpadvancefilter "@rx (?i)(union(\s|/\*.*\*/)+select|--|/\*|;|sleep\(|information_schema)" \
    "id:1026114210,phase:2,deny,status:403,log,msg:'CVE-2026-11421 ERP erpadvancefilter SQLi attempt'"