CVE-2026-126808
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-863
Not enough EPSS history yet.
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history.
- github.comhttps://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225
- github.comhttps://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263
- github.comhttps://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0
- github.comhttps://github.com/wp-erp/wp-erp/issues/1691
- github.comhttps://github.com/wp-erp/wp-erp/pull/1693
- www.vulncheck.comhttps://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-126872——
———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-126866——
———Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)3hCVE-2026-126860——
———Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-126854——
———Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-126850——
———Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)3hCVE-2026-1262519.1 CRI—
———A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.4h