The WP ERP | Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress suffers from a union-based SQL Injection vulnerability via the 'email' parameter. The flaw exists due to improper neutralization of special elements in SQL commands, specifically insufficient escaping and lack of prepared statements. Authenticated attackers with subscriber-level privileges or higher can exploit this to append arbitrary SQL queries to existing ones, potentially extracting sensitive data from the database. The vulnerability is tracked as CVE-2024-0608 and has a CVSS 3.1 base score of 6.5 (medium severity).

An attacker with subscriber-level or higher access can exploit this vulnerability to perform unauthorized SQL queries, leading to potential disclosure of sensitive information stored in the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious activity related to SQL queries involving the 'email' parameter. Avoid using vulnerable versions of the plugin in sensitive environments.