CVE-2023-2744

CVE-2023-2744: vulnerability in WP ERP | Complete HR solution with recruitment…

WP ERP < 1.12.4 - Admin+ SQL Injection

Published · Updated

Follow this CVE+ Monitor WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.6%
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Affected products
Unknown · WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Related CVEs — WP ERP | Complete HR solution with recruitment…

In the same product, most dangerous first.

CVE-2024-12812HIGHWP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee InformationEPSS 0.5%CVE-2023-2743MEDIUMWP ERP < 1.12.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-12808MEDIUMWP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSSEPSS 0.3%