CVE-2026-13011 describes an SQL Injection vulnerability in the ERP: Complete HR, Accounting & CRM Suite plugin for WooCommerce on WordPress. The issue arises from improper neutralization of special elements in the 'orderby' parameter, which is insufficiently escaped and prepared in SQL queries. Authenticated attackers with the erp_list_employee capability (HR Manager-level and above) can append malicious SQL to existing queries, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 1.17.5. No official patch or remediation level has been provided by the vendor as of the publication date.

An attacker with authenticated access and HR Manager-level privileges can exploit this vulnerability to perform SQL Injection attacks, allowing unauthorized reading of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict HR Manager-level access to trusted users only and monitor for suspicious activity related to the 'orderby' parameter. Avoid granting the erp_list_employee capability broadly. Follow vendor channels for updates and apply patches promptly once available.