CVE-2026-15349

MediumCVSS 4.3/10Last modified Jul 17, 2026

Description

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2026
Last modified: Jul 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-15359.8A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrat CVE-2026-153504.3The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to CVE-2026-153514.9The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injecti CVE-2026-153527.5A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash CVE-2026-153587.5ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal CVE-2026-153596.5The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated CVE-2026-15365.3A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line CVE-2026-153609.1The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing CVE-2026-153618.1The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise CVE-2026-153652.4A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.CVE-2026-153662.4A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page CVE-2026-153688.1The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to th