CVE-2026-13011: WP ERP Plugin SQL Injection Vulnerability

CVE-2026-13011 Overview

CVE-2026-13011 is a SQL Injection vulnerability [CWE-89] in the WP ERP plugin for WordPress, marketed as the Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support. The flaw affects all versions up to and including 1.17.5. The vulnerability exists in the orderby parameter, which lacks sufficient escaping and query preparation. Authenticated attackers with custom-level access or above can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive information from the WordPress database. Exploitation requires the erp_list_employee capability, granted to HR Manager-level users and above.

Critical Impact
Authenticated users at the HR Manager level or above can execute arbitrary SQL queries against the WordPress database, exposing employee records, credentials, and other sensitive HR data.

Affected Products

WP ERP: Complete HR, Accounting & CRM Suite plugin for WordPress
All versions up to and including 1.17.5
WordPress sites using the WP ERP HRM module with delegated HR Manager access

Discovery Timeline

2026-07-09 - CVE-2026-13011 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-13011

Vulnerability Analysis

The vulnerability resides in the WP ERP HRM module, specifically in the leave request listing functionality. The orderby parameter passed to the LeaveRequestsListTable component is concatenated into a SQL query without adequate sanitization or use of prepared statements. This allows an authenticated attacker to inject arbitrary SQL fragments that are executed with the privileges of the WordPress database user.

The attack surface is limited to authenticated sessions holding the erp_list_employee capability. HR Manager-level accounts and above possess this capability by default within the plugin's role mapping. Attackers who compromise or provision such an account can extract sensitive records from wp_users, wp_usermeta, and WP ERP HRM tables containing employee personal data.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The vulnerable code paths in modules/hrm/includes/LeaveRequestsListTable.php (line 384) and modules/hrm/includes/functions-leave.php (lines 1408, 1409, and 1521) accept the user-controlled orderby value and incorporate it directly into the SQL statement. The plugin does not validate the parameter against an allowlist of column names, nor does it wrap the value through wpdb::prepare() with a proper placeholder.

Attack Vector

Exploitation is performed over the network against the WordPress admin interface. The attacker authenticates as an HR Manager (or higher), navigates to the leave requests listing, and manipulates the orderby request parameter to append a UNION-based or stacked injection payload. Because the injection is reflected into the sorting clause, blind and UNION-based extraction techniques are both feasible. No user interaction from other users is required.

For technical details on the vulnerable code paths, see the WordPress ERP Leave Request Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-13011

Indicators of Compromise

HTTP requests to WP ERP admin endpoints containing SQL metacharacters, UNION SELECT, SLEEP(, information_schema, or comment sequences in the orderby parameter.
Unusually long or URL-encoded orderby values submitted by HR Manager accounts.
Database error entries in the WordPress debug.log referencing LeaveRequestsListTable queries.
Authenticated sessions from HR Manager users originating from anomalous IP addresses or geographies.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the orderby query parameter on WP ERP endpoints and blocks non-allowlisted values.
Enable WordPress query logging or a plugin such as Query Monitor to capture the raw SQL executed by the HRM module.
Correlate authentication logs against WP ERP administrative actions to identify session takeover or privilege abuse.

Monitoring Recommendations

Monitor the wp_erp_hr_leave_requests and related tables for unexpected read volumes or full-table scans.
Alert on WordPress PHP error log entries containing mysqli or wpdb SQL syntax errors tied to HRM code paths.
Track privilege changes that assign the erp_list_employee capability to new users.

How to Mitigate CVE-2026-13011

Immediate Actions Required

Upgrade the WP ERP plugin to a version later than 1.17.5 as soon as the vendor publishes a fixed release referenced in the WordPress ERP Changeset Log.
Audit all WordPress accounts that hold HR Manager or higher roles and revoke unnecessary access.
Rotate credentials and API keys stored in the WordPress database if HR Manager accounts show signs of compromise.
Restrict /wp-admin access to trusted networks using web server access controls.

Patch Information

The vendor addressed the issue in a changeset committed to the WP ERP source repository. Administrators should review the WordPress ERP Changeset Log and apply the update through the WordPress plugin manager. Confirm the installed plugin version is greater than 1.17.5 after the update.

Workarounds

Temporarily remove the erp_list_employee capability from non-essential HR Manager accounts until the patch is applied.
Deploy a WAF rule that enforces an allowlist of valid orderby column names such as name, status, and created_at.
Disable the WP ERP HRM leave requests module if it is not in active use.
Enforce multi-factor authentication on all WordPress accounts with HR Manager or administrator privileges.

bash

# Example ModSecurity rule to block SQL metacharacters in the orderby parameter
SecRule ARGS:orderby "@rx (?i)(union|select|sleep|information_schema|--|/\*|;)" \
  "id:1013011,phase:2,deny,status:403,log,msg:'CVE-2026-13011 WP ERP orderby SQLi attempt'"