ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce

Software Type	Plugin
Software Slug	erp (view on wordpress.org)
Software Status	Active
Software Author	wedevs
Software Website	wperp.com
Software Downloads	731,114
Software Active Installs	5,000
Software Record Last Updated	October 14, 2026

Showing 1-20 of 28 Vulnerabilities

Submit a Vulnerability

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection

7.5

CVE-2026-96343

Sep 28, 2026

Researcher: Ananda Dhakal

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection

6.5

CVE-2026-96346

Sep 23, 2026

Researcher: Ananda Dhakal

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment

9.8

CVE-2026-18080

Aug 25, 2026

Researcher: Talal Nasraddeen

ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter

6.5

CVE-2026-11421

Aug 4, 2026

Researcher: Hyunsoo Jeong

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler

4.3

CVE-2026-15349

Jul 16, 2026

Researcher: Wordfence PRISM

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 - Missing Authorization

4.3

CVE-2026-59522

Jul 15, 2026

Researchers:

ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter

6.5

CVE-2026-13011

Jul 8, 2026

Researcher: Wordfence PRISM

ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection

6.5

CVE-2026-31917

Feb 5, 2026

Researcher: daroo

ERP <= 1.16.7 - Missing Authorization

5.3

CVE-2025-63008

Dec 4, 2025

Researcher: Legion Hunter

ERP <= 1.16.6 - Authenticated (Subscriber+) Information Exposure

4.3

CVE-2025-67546

Nov 26, 2025

Researcher: daroo

WP ERP <= 1.13.4 - Missing Authorization

4.3

CVE-2025-30896

Mar 27, 2025

Researcher: theviper17y

WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference

4.3

CVE-2024-12812

Mar 3, 2025

Researcher: Pedro Cuco (Illex)

WP ERP <= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-12808

Mar 3, 2025

Researcher: Pedro Cuco (Illex)

WP ERP <= 1.13.2 - Reflected Cross-Site Scripting

6.1

CVE-2024-47640

Oct 21, 2024

Researcher: Le Ngoc Anh

WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id

8.8

CVE-2024-6666

Jul 10, 2024

Researcher: Edwin Siebel (edwinsiebel)

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection

7.2

CVE-2024-1173

May 1, 2024

Researcher: Edwin Siebel (edwinsiebel)

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection

6.5

CVE-2024-0608

Mar 28, 2024

Researcher: Krzysztof Zając

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-0609

Mar 28, 2024

Researcher: Krzysztof Zając

WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection

4.9

CVE-2024-0956

Mar 28, 2024

Researcher: Edwin Siebel (edwinsiebel)

WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection

7.2

CVE-2024-0913

Mar 28, 2024

Researcher: Edwin Siebel (edwinsiebel)

Title	Status	CVE ID	CVSS	Researchers	Date
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection	Patched	CVE-2026-96343	7.5	Ananda Dhakal	September 28, 2026
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection	Patched	CVE-2026-96346	6.5	Ananda Dhakal	September 23, 2026
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment	Patched	CVE-2026-18080	9.8	Talal Nasraddeen	August 25, 2026
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter	Patched	CVE-2026-11421	6.5	Hyunsoo Jeong	August 4, 2026
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler	Patched	CVE-2026-15349	4.3	Wordfence PRISM	July 16, 2026
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 - Missing Authorization	Patched	CVE-2026-59522	4.3		July 15, 2026
ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter	Patched	CVE-2026-13011	6.5	Wordfence PRISM	July 8, 2026
ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection	Patched	CVE-2026-31917	6.5	daroo	February 5, 2026
ERP <= 1.16.7 - Missing Authorization	Patched	CVE-2025-63008	5.3	Legion Hunter	December 4, 2025
ERP <= 1.16.6 - Authenticated (Subscriber+) Information Exposure	Patched	CVE-2025-67546	4.3	daroo	November 26, 2025
WP ERP <= 1.13.4 - Missing Authorization	Patched	CVE-2025-30896	4.3	theviper17y	March 27, 2025
WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference	Patched	CVE-2024-12812	4.3	Pedro Cuco (Illex)	March 3, 2025
WP ERP <= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2024-12808	4.4	Pedro Cuco (Illex)	March 3, 2025
WP ERP <= 1.13.2 - Reflected Cross-Site Scripting	Patched	CVE-2024-47640	6.1	Le Ngoc Anh	October 21, 2024
WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id	Patched	CVE-2024-6666	8.8	Edwin Siebel (edwinsiebel)	July 10, 2024
WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection	Patched	CVE-2024-1173	7.2	Edwin Siebel (edwinsiebel)	May 1, 2024
WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2024-0608	6.5	Krzysztof Zając	March 28, 2024
WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2024-0609	7.2	Krzysztof Zając	March 28, 2024
WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection	Patched	CVE-2024-0956	4.9	Edwin Siebel (edwinsiebel)	March 28, 2024
WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection	Patched	CVE-2024-0913	7.2	Edwin Siebel (edwinsiebel)	March 28, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation