Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action
Published Jul 9, 2026
4.3
MEDIUMCVSS 3.1
EPSS 0.39%
Description
The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.
Affected products
- Vendor Crewhrm Product Employee, Leave and Recruitment Management System – Crew HRM Defaultunaffected
- Version 0StatusaffectedConstraints<=1.2.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Crewhrm | Employee, Leave and Recruitment Management System – Crew HRM | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Jul 9, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Jul–Oct 2026- EPSS v5
Percentile over time
- EPSS v5
Table of values (2 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.39% (0.00394) | 31.16th | v5 (v2026.06.15) |
| Jul 10, 2026 | 0.23% (0.00227) | 13.35th | v5 (v2026.06.15) |
References (7)
- https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Controllers/JobManagement.php#L151
- https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Controllers/JobManagement.php#L29
- https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Models/User.php#L73
- https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Setup/Dispatcher.php#L123
- https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Setup/Dispatcher.php#L139
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3556031%40hr-management&new=3556031%40hr-management
- https://www.wordfence.com/threat-intel/vulnerabilities/id/be30e951-7c8d-4baf-9288-0d12dacc0dc2?source=cve
Change history (0)
No recorded changes yet.