CVE-2026-9237 is an authorization bypass vulnerability (CWE-862) in the Crew HRM WordPress plugin affecting all versions up to and including 1.2.2. The plugin fails to properly verify user authorization before allowing actions on job listings, including deletion, archiving, unarchiving, and duplication. The vulnerability arises because the nonce used for request validation is exposed to all authenticated front-end users via wp_head script localization, enabling low-privilege users (subscribers) to satisfy the nonce check and perform unauthorized actions by supplying arbitrary job IDs.

An attacker with subscriber-level access can manipulate job listings and their associated data without proper authorization. This leads to unauthorized modification of job-related content, potentially disrupting recruitment workflows and data integrity. The vulnerability does not impact confidentiality or availability but allows integrity violations within the affected plugin's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious activity related to job listing management. Avoid granting unnecessary authenticated access to untrusted users.