WordPress Crew HRM <=1.2.2 Missing AuthN Arbitrary Job Deletion (CVE-2026-9237)

Vulnerability Overview Vulnerability Name: Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action CVE ID: CVE-2026-9237 CVSS Score: 4.3 (Medium) Published Date: July 8, 2026 Last Updated: July 9, 2026 Researchers: Md. Moniruzzaman Prodhon (NormanProdhon) - Knight Squad Affected Software Software Type: Plugin Software Slug: hr-management (view on wordpress.org) Affected Versions: <= 1.2.2 Fixed Version: 1.2.3 Remediation Recommendation: Update to version 1.2.3 or later. Description This vulnerability exists in the Employee, Leave and Recruitment Management System – Crew HRM plugin, versions 1.2.2 and earlier. Due to insufficient validation of user permissions, an authenticated attacker (with Subscriber-level or higher privileges) can delete, archive, unarchive, and duplicate arbitrary job listings along with their associated stages, metadata, addresses, and applications. Attackers can exploit this vulnerability by providing an arbitrary parameter, as the nonce validation is exposed to all authenticated frontend visitors via the script localizations in . References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Facebook X (Twitter) LinkedIn Email Additional Information Recent Vulnerabilities: - Title: Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 - Missing Authorization - CVE ID: CVE-2026-27351 - CVSS Score: 4.3 - Researchers: benedus - Date: June 2, 2026 - Title: Crew HRM <= 1.1.1 - Unauthenticated PHP Object Injection - CVE ID: CVE-2024-43252 - CVSS Score: 8.1 - Researchers: CatFather - Date: August 12, 2024 Disclaimer This record contains copyrighted material. License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Defiant's software vulnerability information. Any copies must include a link to this license. License: CVE Usage. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE) information. Any copies must include a link to this license. Contact To add or correct information, please contact: wfsupport@wordfence.com Business Hours Our business hours are 9 AM - 8 PM ET and 2 PM - 1 AM UTC/GMT, excluding weekends and holidays. We provide 24/7 support for customers, 365 days a year, with a 1-hour response time. Terms of Service Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - Latest News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Careers - Contact - Security - CVE Request Form Subscribe for Updates Sign up for news and updates to receive information from our experienced security professionals team. By checking this box, I agree to the Terms of Service and Privacy Policy. Copyright © 2012-2026 Defiant Inc. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Crew HRM <=1.2.2 Missing AuthN Arbitrary Job Deletion (CVE-2026-9237)

More from this source