CVE-2025-5956

Katalog CVE

CVSS 8.1 · High EPSS 0,36%

Kerentanan Missing Authorization pada mishubd wp human resource management. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.

Rincian

Terbit di NVD

4 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.wordfence.com/threat-intel/vulnerabilities/id/28cf0f3f-0048-4da9-aa86-243479f7b974?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L48 product
• https://wordpress.org/plugins/hrm/#developers release notes