CVE-2026-27351

MediumCVSS 5.4

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM from n/a through 1.2.2.

Risk Assessment

Unauthorized users may gain access to administrative functions or sensitive data, potentially leading to confidentiality and integrity breaches.

Recommendation

Update the Crew HRM plugin to the latest version if available, or apply proper access control rules.

Other vulnerabilities in Crew HRM

CVE-2026-9237Medium
The Crew HRM plugin for WordPress up to version 1.2.2 suffers from an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can delete, archive, unarchive, and duplicate arbitrary job listings along with associated data due to improper permission verification and an exposed nonce.

Original NVD description (English source)

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS