CVE-2026-9237: Crew HRM WordPress Plugin Authorization Bypass – Subscriber Job Deletion Vulnerability

Technical summary

CVE-2026-9237 is an authorization bypass vulnerability in the Crew HRM plugin for WordPress affecting all versions through 1.2.2. The vulnerability stems from two related failures: (1) the Dispatcher::dispatch() function does not properly verify user authorization before performing sensitive job listing operations (deletion, archiving, unarchiving, duplication), and (2) the nonce token used to validate requests is exposed via wp_head script localization, meaning any authenticated front-end user can extract and reuse it. An authenticated attacker can craft requests with an arbitrary job_id parameter and satisfy both the nonce check and reach the vulnerable code path, resulting in unauthorized modification or destruction of job listings, their associated stages, metadata, addresses, and linked applications.

Business impact

Organizations using Crew HRM to manage recruitment workflows face data integrity and availability risks. Malicious or careless subscribers could systematically delete or corrupt active job postings, disrupting hiring pipelines, losing application history, and requiring manual recovery. In multi-tenant or organization-wide deployments, a disgruntled low-privilege user could cause significant operational disruption. Data loss of recruitment records may trigger compliance concerns and erode trust in hiring data accuracy. The ease of exploitation (no special tools required, only subscriber credentials) increases the practical risk compared to vulnerabilities requiring administrative access.

Affected systems

All installations of the Crew HRM plugin for WordPress up to and including version 1.2.2 are vulnerable. Any WordPress site with the plugin installed and at least one subscriber-level user (the default WordPress role for registered users with minimal permissions) is at risk. The vulnerability does not require administrator or editor privileges to exploit, making it accessible to any registered user unless enrollment is strictly controlled.

Exploitability

Exploitability is high relative to the CVSS score. The attack requires only basic subscriber credentials (widely available in most WordPress multiuser environments) and network access. No user interaction or admin privileges are needed. An attacker needs only to know or guess a valid job_id and can perform modifications immediately. The nonce is publicly available in page source, eliminating a key validation hurdle. Proof-of-concept would be straightforward for any developer familiar with WordPress POST requests, though the actual impact is limited to data modification rather than confidentiality breaches or system compromise.

Remediation

Update the Crew HRM plugin to a patched version that properly implements authorization checks before permitting job listing modifications. Verify against the vendor advisory for the specific version addressing CVE-2026-9237. Until patching is possible, restrict subscriber role assignments to trusted users only, monitor job listing change logs for unexpected modifications, and consider disabling the plugin if recruitment functionality is not actively in use. Web application firewalls or WordPress security plugins may provide temporary rate-limiting on suspicious bulk deletion patterns.

Patch guidance

Check the plugin vendor's advisory or repository for version 1.2.3 or later that addresses this vulnerability. Apply the update through the WordPress admin dashboard (Plugins → Updates) or via WP-CLI if available. Test the update in a staging environment first to ensure compatibility with other plugins and themes. Verify that job listings, stages, and applications remain intact post-update. Document the patching action and timeline for audit purposes.

Detection guidance

Monitor WordPress logs and audit trails for unexpected modifications to job listings, particularly bulk deletions or duplications by low-privilege users. Check wp_postmeta and job-related custom tables for rapid sequential changes with timestamps clustering around known subscriber activity. Use WordPress security monitoring plugins to flag authorization bypass patterns. Examine HTTP POST requests targeting job management endpoints with mismatched user roles. Review nonce token exposure in front-end page source if concerned about active exploitation. Correlate subscriber account logins with subsequent job listing modifications.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability warrants prompt attention because: (1) exploitation requires only ubiquitous subscriber credentials, not admin access; (2) the attack is trivial to execute once credentials are obtained; (3) damage is direct and operational (data loss or corruption), affecting business processes immediately; (4) the vulnerability is straightforward to patch, making the remediation cost-benefit favorable. Organizations should prioritize this within their normal patch cycle, not defer it to the next major update window.

Risk score, explained

CVSS 4.3 reflects a MEDIUM severity with low attack complexity, no special privileges or user interaction required, and local scope. The low score results from the impact being limited to integrity (job listing modifications) rather than confidentiality or availability at system level. However, the real-world risk to recruitment operations may feel higher due to operational sensitivity and ease of exploitation by any subscriber. Security teams should not treat the moderate CVSS as low urgency; the low barrier to exploitation and direct business impact justify faster remediation than the score alone might suggest.

Frequently asked questions