10 matches found
CVE-2025-5953
CVE-2025-5953 affects the WordPress plugin WP Human Resource Management (hrm) (versions 2.0.0–2.2.17). The vulnerability arises from missing authorization checks in the AJAX handlers ajax_insert_employee() and update_employee() . The attacker, authenticated with Employee-level access or higher , ...
CVE-2025-5956 WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajaxdeleteemployee function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $POST'delete' array and passes each ID...
CVE-2025-5956
CVE-2025-5956 concerns the WordPress plugin WP Human Resource Management (versions 2.0.0–2.2.17). The root cause is missing authorization in the ajax_delete_employee() handler, which reads $_POST['delete'] and passes IDs to wp_delete_user() without verifying delete_users capability or restricting...
PT-2025-27843 · WordPress · Wp Human Resource Management
Name of the Vulnerable Software and Affected Versions: WP Human Resource Management plugin versions 2.0.0 through 2.2.17 Description: The issue is related to missing authorization in the ajax insert employee and update employee functions. This allows authenticated attackers with Employee-level...
CVE-2025-5953: Missing Authorization
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajaxinsertemployee and updateempoyee functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $POST'role' and, after basic cleaning via...
CVE-2025-5956: Missing Authorization
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajaxdeleteemployee function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $POST'delete' array and passes each ID...
CVE-2019-9573
The CVE-2019-9573 entry concerns the WordPress WP Human Resource Management plugin, specifically versions prior to 2.2.6. The public description states that the plugin mishandles leave applications, indicating a logic/authorization or data-handling issue in how leave requests are processed. CVSS ...
CVE-2019-9573
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications...
CVE-2019-9574: Missing Authorization
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role...