CVE-2026-9237
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Crew HRM plugin for WordPress up to version 1.2.2 suffers from an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can delete, archive, unarchive, and duplicate arbitrary job listings along with associated data due to improper permission verification and an exposed nonce.
Risk Assessment
The organization faces unauthorized manipulation of recruitment data, potentially leading to loss of confidential candidate information and disruption of HR processes.
Recommendation
Immediately update the Crew HRM plugin to the latest available version that fixes this vulnerability, and restrict access to the WordPress admin panel for unauthorized users.
Other vulnerabilities in Crew HRM
Original NVD description (English source)
The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS