CVE-2026-15349: WordPress ERP Plugin Auth Bypass Flaw

CVE-2026-15349 Overview

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 1.17.6. The plugin fails to properly verify user authorization before executing sensitive actions. Authenticated attackers with subscriber-level access or above can create arbitrary company locations in the ERP database. The flaw is tracked as [CWE-862] Missing Authorization and stems from insufficient capability checks on administrative Ajax endpoints. Exploitation requires only a low-privilege account, which is common on WordPress sites that allow user registration.

Critical Impact
Authenticated subscribers can inject arbitrary company location records into the ERP database, corrupting business data integrity.

Affected Products

WordPress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin
All plugin versions up to and including 1.17.6
WordPress sites with subscriber registration enabled and the ERP plugin installed

Discovery Timeline

2026-07-17 - CVE-2026-15349 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-15349

Vulnerability Analysis

The vulnerability resides in the ERP plugin's Ajax handler for creating company locations. The plugin registers Ajax actions that accept requests from any authenticated user but does not verify the user holds the required administrative capability. Referenced code paths include includes/Admin/AdminPage.php, includes/Admin/Ajax.php (lines 23 and 516), and includes/Admin/views/address.php. Because WordPress treats all logged-in users, including subscribers, as valid Ajax callers by default, the missing capability check allows unprivileged accounts to invoke privileged operations. The result is unauthorized write access to ERP company location records used across HR, accounting, and CRM modules.

Root Cause

The root cause is a missing authorization check [CWE-862] on the Ajax endpoint responsible for creating company locations. The plugin relies on nonce verification and authentication state but omits a current_user_can() capability check to confirm the caller has permission to manage ERP data.

Attack Vector

An attacker authenticates to the target WordPress site as a subscriber-level user or higher. The attacker then issues an Ajax POST request to the vulnerable ERP endpoint with crafted parameters describing a company location. The server accepts the request and writes the record without validating the caller's role. See the Wordfence Vulnerability Analysis and the WordPress ERP Ajax source for technical details.

Detection Methods for CVE-2026-15349

Indicators of Compromise

Unexpected company location entries in the ERP database tables that were not created by administrators
Ajax requests to ERP action handlers originating from accounts with subscriber or customer roles
New WordPress user registrations followed shortly by Ajax POST requests to admin-ajax.php targeting ERP actions

Detection Strategies

Review WordPress access logs for POST requests to /wp-admin/admin-ajax.php referencing ERP-related action parameters from low-privilege accounts
Audit ERP company location records against a known-good baseline and flag entries created by non-administrator user IDs
Enable WordPress audit logging to capture role-to-action mismatches, such as subscribers invoking administrative Ajax handlers

Monitoring Recommendations

Monitor plugin version inventory across WordPress sites and alert on installations running ERP 1.17.6 or earlier
Alert on bulk creation of ERP records within short time windows, which suggests scripted abuse
Correlate new user registration events with immediate privileged Ajax activity to identify opportunistic exploitation

How to Mitigate CVE-2026-15349

Immediate Actions Required

Update the ERP: Complete HR, Accounting & CRM Suite plugin to a version later than 1.17.6 as soon as the vendor publishes a fixed release
Audit existing ERP company location records and remove entries created by unauthorized accounts
Review the WordPress user list and remove or downgrade unnecessary subscriber-level accounts

Patch Information

The vendor's remediation is tracked in the WordPress ERP Changeset. Site administrators should apply the updated plugin release through the WordPress plugin manager and verify the installed version after upgrade.

Workarounds

Disable open user registration under WordPress Settings > General to prevent untrusted account creation
Restrict access to /wp-admin/admin-ajax.php for low-privilege roles using a web application firewall rule targeting ERP action names
Temporarily deactivate the ERP plugin on sites that permit public registration until the patched version is deployed

bash

# Configuration example: disable public registration via wp-cli
wp option update users_can_register 0

# Verify installed ERP plugin version
wp plugin get erp --field=version