CVE-2026-13011: WP ERP SQL Injection via orderby Parameter - HR Manager Access Required

Technical summary

CVE-2026-13011 is a SQL injection flaw in the WP ERP Complete HR, Accounting & CRM Suite plugin (versions up to 1.17.5) affecting the 'orderby' parameter used in employee list queries. The plugin fails to properly escape and prepare the user-supplied parameter before incorporating it into SQL statements. Attackers possessing the erp_list_employee capability—automatically granted to HR Manager-level and above roles—can append arbitrary SQL to extract data. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and carries a CVSS 3.1 score of 6.5 (Medium severity) due to the requirement for authenticated access and lack of integrity/availability impact.

Business impact

Organizations using WP ERP risk unauthorized exposure of sensitive HR and employee data, including personal information, compensation details, recruitment records, and potentially accounting records. While direct database corruption or system unavailability is not possible through this vector, the confidentiality breach could expose employee PII, creating regulatory compliance issues (GDPR, state privacy laws) and reputational harm. The attack surface is limited to users with HR Manager roles, but in many organizations that represents multiple staff members with legitimate business access.

Affected systems

The WP ERP Complete HR, Accounting & CRM Suite plugin for WordPress in version 1.17.5 and earlier is affected. The vulnerability is specific to installations where the erp_list_employee capability is in use, typically granted to HR Manager-level users and above. Any WordPress site running an affected version of the plugin with active HR management workflows is potentially vulnerable.

Exploitability

Exploitation requires valid WordPress credentials with at least HR Manager-level access. An attacker must either compromise such an account or already be a privileged internal user. No authentication bypass is required, and no user interaction is needed beyond typical plugin usage. Once authenticated, crafting malicious SQL via the orderby parameter requires standard SQL injection techniques but is not administratively complex. The barrier to entry is moderate; the vulnerability is not exploitable by anonymous users, but any compromised HR staff account becomes a pivot point for data extraction.

Remediation

Organizations should immediately patch the WP ERP plugin to a version beyond 1.17.5 that includes proper parameter escaping and SQL query preparation. Verify the availability of a patched version through the official WordPress plugin repository or the vendor's advisory. As an interim control, restrict the erp_list_employee capability to the minimum set of HR staff who genuinely require employee list access, reducing the attack surface. Monitor database query logs for unusual SQL patterns emanating from WordPress application queries.

Patch guidance

Apply the vendor patch by updating the WP ERP plugin to the latest available version that resolves this SQL injection. Verify the patch version against the official WordPress plugin repository or vendor security advisory to confirm the fix addresses CWE-89 in the orderby parameter handling. Test the patch in a staging environment before production deployment to ensure compatibility with other plugins and custom configurations. After patching, confirm that employee list functionality continues to operate normally and that no database integrity issues remain from prior exploitation attempts.

Detection guidance

Monitor WordPress database query logs and application-level logging for SQL commands originating from the WP ERP employee list endpoint that contain unexpected SQL keywords (UNION, SELECT, OR, AND) within the orderby parameter value. Audit WordPress user role assignments to identify which accounts hold HR Manager or above privileges. Review access logs for the employee list page to detect unusual access patterns from unexpected user accounts. Implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads in the orderby parameter before they reach the database. Database activity monitoring tools can flag suspicious query patterns typical of SQL injection reconnaissance.

Why prioritize this

Although this vulnerability requires authenticated access and is not remotely exploitable by anonymous attackers, it presents a clear path to sensitive data exfiltration for insiders or attackers who have compromised an HR staff account. The business data at risk—employee records, compensation, recruitment pipelines—carries high confidentiality sensitivity. The prevalence of the WP ERP plugin in mid-market HR departments and the relative ease of exploitation once authenticated justify prioritization over truly complex, low-impact vulnerabilities. This is a 'patch soon' rather than 'patch immediately' issue, but should not be deferred.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects the balance between a meaningful confidentiality impact (high) and the requirement for valid authentication at a specific privilege level (HR Manager or above). The attack vector is network-accessible, but the privilege requirement and lack of impact on integrity or availability prevent a higher score. For a multi-tenant or shared hosting environment where HR staff accounts may be more numerous, the practical risk may be perceived as higher; conversely, highly restricted environments with few HR Manager accounts may rate it lower relative to their threat model.

Frequently asked questions