Threats tagged 'ghsa-6vcx-gwjm-xrg8'

A vulnerability in The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before version 1.17.11 allows any authenticated user, including those with minimal privileges like Subscribers, to access sensitive HR, CRM, and Accounting data. This occurs because the plugin fails to perform a capability check on an AJAX action that returns stored before-and-after values of record changes, enabling unauthorized data enumeration.