CVE-2026-4834 is an SQL Injection vulnerability in the WP ERP Pro WordPress plugin affecting all versions up to 1.5.1. The issue arises from improper neutralization of special elements in the 'search_key' parameter, allowing attackers to append malicious SQL queries to existing database queries. This vulnerability is exploitable remotely without authentication or user interaction, potentially exposing sensitive data. The CVSS 3.1 base score is 7.5, indicating high severity. No patch or official remediation level has been provided by the vendor or authoritative sources at this time.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database. The attacker does not need authentication or user interaction to exploit the flaw. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or applying custom input validation and query parameterization to mitigate risk.