4.3
Medium
CVE-2026-15349 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization…
Description
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce 1.17 | earliest → 1.17.6 | No fix stated |
Other CVEs of ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
The 5 CVEs of ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce →
CVE-2026-96894
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored…
7.2
High
CVE-2026-18080
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted…
9.8
Critical
CVE-2026-11421
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL…
6.5
Medium
CVE-2026-13011
The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is…
6.5
Medium