The ERP: Complete HR, Accounting & CRM Suite plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in versions <=1.17.4. The plugin uses sanitize_text_field on this parameter, which does not escape single quotes, and then directly interpolates the value into a single-quoted SQL WHERE clause executed by $wpdb->get_results(). Authenticated users with the CRM Agent role or higher and the erp_crm_list_contact capability can append additional SQL queries, potentially extracting sensitive database information.

An attacker with authenticated access at the CRM Agent role or higher can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized extraction of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict CRM Agent role assignments to trusted users only and monitor for suspicious activity related to the 'erpadvancefilter' parameter. Avoid exposing this plugin to untrusted users.