Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action
medium
The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wi...
- CVSS:
- 4.3
- Affected:
- up to 1.2.2
- Fixed in:
- 1.2.3
- Disclosed:
- Jul 8, 2026
CVE-2026-9237 on NVD →
Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 - Missing Authorization
medium
The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an un...
- CVSS:
- 4.3
- Affected:
- up to 1.2.2
- Fixed in:
- 1.2.3
- Disclosed:
- Jun 2, 2026
CVE-2026-27351 on NVD →
Crew HRM <= 1.1.1 - Unauthenticated PHP Object Injection
high
The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in th...
- CVSS:
- 8.1
- Affected:
- up to 1.1.1
- Fixed in:
- 1.1.2
- Disclosed:
- Aug 12, 2024
CVE-2024-43252 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database