WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
high
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), pas...
- CVSS:
- 8.8
- Affected:
- 2.0.0 – 2.2.17
- Fix:
- No patched version reported
- Disclosed:
- Jul 3, 2025
CVE-2025-5953 on NVD →
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
medium
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_dele...
- CVSS:
- 6.5
- Affected:
- 2.0.0 – 2.2.17
- Fix:
- No patched version reported
- Disclosed:
- Jul 3, 2025
CVE-2025-5956 on NVD →
WP Human Resource Management < 2.2.6 - Sensitive Information Disclosure
high
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role. This allows any authenticated user to access sensitive user information, including hashed passwords, via the search_emp_leave_records action.
- CVSS:
- 7.5
- Affected:
- up to 2.2.6
- Fixed in:
- 2.2.6
- Disclosed:
- Mar 17, 2019
CVE-2019-9574 on NVD →
WP Human Resource Management [hrm] < 2.2.6 (closed)
unknown
[en] The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
- Affected:
- up to 2.2.6
- Fixed in:
- 2.2.6
- Disclosed:
- Mar 5, 2019
CVE-2019-9573 on NVD →
WP Human Resource Management [hrm] < 2.2.6 (closed)
unknown
[en] The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
- Affected:
- up to 2.2.6
- Fixed in:
- 2.2.6
- Disclosed:
- Mar 5, 2019
CVE-2019-9574 on NVD →
WP Human Resource Management Plugin < 2.2.6 - Authorization Bypass
high
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
- CVSS:
- 7.5
- Affected:
- up to 2.2.6
- Fixed in:
- 2.2.6
- Disclosed:
- Feb 23, 2019
CVE-2019-9573 on NVD →
WP Human Resource Management [hrm] >= 2.0.0 - <= 2.2.17 (unfixed + closed)
unknown
- Affected:
- 2.0.0 – 2.2.17
- Fix:
- No patched version reported
CVE-2025-5956 on NVD →
WP Human Resource Management [hrm] >= 2.0.0 - <= 2.2.17 (unfixed + closed)
unknown
- Affected:
- 2.0.0 – 2.2.17
- Fix:
- No patched version reported
CVE-2025-5953 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database