This vulnerability, identified as CWE-862 (Missing Authorization), affects WP ERP versions up to 1.17.5. It allows users with subscriber privileges to bypass intended access controls, resulting in unauthorized read access to sensitive information. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity and no user interaction required. The impact is limited to confidentiality, with no integrity or availability impact reported. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with subscriber-level access can gain unauthorized read access to sensitive data within WP ERP, compromising confidentiality. There is no reported impact on data integrity or system availability. This could lead to exposure of sensitive business or employee information managed by the ERP system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unusual access patterns. Avoid granting subscriber privileges to untrusted users.