WP ERP Plugin <= 1.17.5 Authenticated SQL Injection via orderby Parameter

Vulnerability Overview Vulnerability Name: ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter CVE ID: CVE-2026-13011 CVSS Score: 6.5 (Medium) Publication Date: July 8, 2026 Last Updated: July 9, 2026 Researcher: PRISM Affected Products Software Type: Plugin Software Name: ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Affected Versions: <= 1.17.5 Fixed Version: 1.17.6 Remediation Recommendation: Update to version 1.17.6 or later patched versions. Vulnerability Description This vulnerability allows an authenticated attacker (with HR Manager level access) to inject SQL queries via the 'orderby' parameter to extract sensitive information from the database. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org theviper17y plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection - CVE ID: CVE-2026-31917 - CVSS Score: 6.5 - Researcher: daroo - Date: February 5, 2026 ERP <= 1.16.7 - Missing Authorization - CVE ID: CVE-2025-63008 - CVSS Score: 5.3 - Researcher: Legion Hunter - Date: December 4, 2025 ERP <= 1.16.6 - Authenticated (Subscriber+) Information Exposure - CVE ID: CVE-2025-67546 - CVSS Score: 4.3 - Researcher: daroo - Date: November 26, 2025 WP ERP <= 1.13.4 - Missing Authorization - CVE ID: CVE-2025-30896 - CVSS Score: 4.3 - Researcher: theviper17y - Date: March 27, 2025 WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference - CVE ID: CVE-2024-12812 - CVSS Score: 4.3 - Researcher: Pedro Cuco (Illex) - Date: March 3, 2025 WP ERP <= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting - CVE ID: CVE-2024-12808 - CVSS Score: 4.4 - Researcher: Pedro Cuco (Illex) - Date: March 3, 2025 WP ERP <= 1.13.2 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-47640 - CVSS Score: 6.1 - Researcher: Le Ngoc Anh - Date: October 21, 2024 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id - CVE ID: CVE-2024-6666 - CVSS Score: 8.8 - Researcher: Edwin Siebel (edwinsiebel) - Date: July 10, 2024 WP ERP - CVE ID: CVE-2024-1173 - CVSS Score: 7.2 - Researcher: Edwin Siebel (edwinsiebel) - Date: May 1, 2024 WP ERP - CVE ID: CVE-2024-0669 - CVSS Score: 7.2 - Researcher: Krzysztof Zając - Date: March 28, 2024 More Information View more vulnerabilities in this software package: VIEW MORE VULNERABILITIES IN THIS SOFTWARE PACKAGE Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Used under the license terms of Defiant Inc. Contact Information Contact Email: wfsupport@wordfence.com Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: X Facebook: f Instagram: o YouTube: o Products and Services Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscribe for Updates Subscribe: Sign Up Disclaimer Disclaimer: Disclaimer Other Other: Other Summary This webpage primarily introduces an SQL injection vulnerability in the ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin, providing detailed vulnerability information, affected scope, remediation solutions, and relevant reference links. The page also lists other recent vulnerabilities for this plugin and provides information on Wordfence Intelligence services and contact details.

Goal Reached Thanks to every supporter — we hit 100%!

WP ERP Plugin <= 1.17.5 Authenticated SQL Injection via orderby Parameter

More from this source