Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2020-36735: WP ERP Plugin Can Be Hacked by Fake Links
CVE-2020-36735 · published 3 years ago
Summary
A security weakness in the WP ERP plugin for WordPress allows hackers to trick administrators into making changes to the plugin settings by clicking on a malicious link. This can lead to unauthorized modifications to the plugin. To fix this, update the plugin to a version higher than 1.6.3.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wedevs | wp_erp |
<= 1.6.3 cpe:2.3:a:wedevs:wp_erp:*:*:*:*:*:wordpress:*:* |
Original advisory text
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1...
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_crm_contact functions. This makes it possible for unauthenticated attackers to modify the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
- https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ Not Applicable
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf... Not Applicable
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilitie... Not Applicable
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilitie... Not Applicable
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilitie... Not Applicable
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilitie... Not Applicable
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilitie... Not Applicable
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old... Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/01b90498-0ddb-4eb3-b76... Exploit Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published1 Jul 2023
Updated4 Nov 2026
First seen2 Apr 2026
Track software like this
Free during beta