Description
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
References (3)
Core 3
Core References
Product, Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/hrm/#developers
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/03/17/1
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/107464
Scores
CVSS v3
7.5
EPSS
0.0241
EPSS Percentile
82.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-862
Status
published
Products (1)
mishubd/wp_human_resource_management
< 2.2.6
Published
Mar 05, 2019
Tracked Since
Feb 18, 2026