CVE-2024-12812
WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information
High · published May 15, 2025
What it is
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00543 · 44.9th percentile
- Published
- 2025-05-15T20:06Z
EPSS history
Timeline