VulnSocial

CVE-2026-105191

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-05: 111-05
Referenced assets1 URL
Full discourse1 post
  • Donweb Media@DonwebMedia

    Si tenés WooCommerce ERP instalado, ojo: cualquier Subscriber puede curiosear datos de RR.HH. y contabilidad que no son suyos. Ya hay fix: actualizá a la 1.17.11 hoy mismo. https://seguridadenwordpress.com/vulnerabilidad-woocommerce-erp-cve-2026-105191/ #WordPress #WooCommerce

    0000035
    10 followersView on X

Explore more

Back to dashboard