CVE-2024-12812 WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information

What is CVE-2024-12812?

CVE-2024-12812 is a high-severity missing authorization vulnerability in Unknown WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting, published on 15 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.

Weakness: CWE-862

Which versions are affected by CVE-2024-12812?

It affects 1 product.

Products include Wedevs Wp Erp.

How do I fix CVE-2024-12812?

No fix has been published for CVE-2024-12812 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-12812 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12812 exists.

Other vulnerabilities in Unknown WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

• CVE-2024-6666 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id High 8.8
• CVE-2024-21747 WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection High 7.6
• CVE-2024-1173 SQL injection in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support High 7.2
• CVE-2024-0952 WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id High 7.2
• CVE-2024-0609 Cross-site scripting in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r77g-4w8g-2vqq.