14 matches found
CVE-2025-5953
CVE-2025-5953 affects the WordPress plugin WP Human Resource Management (hrm) (versions 2.0.0–2.2.17). The vulnerability arises from missing authorization checks in the AJAX handlers ajax_insert_employee() and update_employee() . The attacker, authenticated with Employee-level access or higher , ...
CVE-2025-5956 WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajaxdeleteemployee function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $POST'delete' array and passes each ID...
CVE-2025-5956
CVE-2025-5956 concerns the WordPress plugin WP Human Resource Management (versions 2.0.0–2.2.17). The root cause is missing authorization in the ajax_delete_employee() handler, which reads $_POST['delete'] and passes IDs to wp_delete_user() without verifying delete_users capability or restricting...
CVE-2025-5956: Missing Authorization
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajaxdeleteemployee function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $POST'delete' array and passes each ID...
PT-2025-27843 · WordPress · Wp Human Resource Management
Name of the Vulnerable Software and Affected Versions: WP Human Resource Management plugin versions 2.0.0 through 2.2.17 Description: The issue is related to missing authorization in the ajax insert employee and update employee functions. This allows authenticated attackers with Employee-level...
CVE-2025-5953: Missing Authorization
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajaxinsertemployee and updateempoyee functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $POST'role' and, after basic cleaning via...
CVE-2019-9573
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications...
CVE-2019-9573
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications...
CVE-2019-9573
The CVE-2019-9573 entry concerns the WordPress WP Human Resource Management plugin, specifically versions prior to 2.2.6. The public description states that the plugin mishandles leave applications, indicating a logic/authorization or data-handling issue in how leave requests are processed. CVSS ...
CVE-2019-9574
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role...
PT-2019-19718
Name of the Vulnerable Software and Affected Versions WP Human Resource Management plugin versions prior to 2.2.6 Description The issue is related to the mishandling of leave applications in the WP Human Resource Management plugin for WordPress. Recommendations For versions prior to 2.2.6, update...
PT-2019-19719
Name of the Vulnerable Software and Affected Versions WP Human Resource Management plugin versions prior to 2.2.6 Description The issue arises from the lack of proper role-based access control in the WP Human Resource Management plugin, allowing leave modifications to occur outside of the intende...
CVE-2019-9574: Missing Authorization
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role...