CVE-2026-11421
Received Received - Intake

SQL Injection in ERP Complete HR Accounting & CRM Suite for WooCommerce

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-11421
EUVD
EUVD-2026-53041

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp-erp erp_complete_hr_accounting_crm_suite to 1.17.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection flaw in the ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress. It exists due to insufficient escaping of the 'erpadvancefilter' parameter and lack of proper SQL query preparation. The plugin uses sanitize_text_field which preserves single quotes, allowing attackers to inject malicious SQL code into queries.

Detection Guidance

To detect this vulnerability, check if the plugin 'ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support' is installed and verify its version. If it is version 1.17.4 or lower, the system is vulnerable. Use WordPress admin access to inspect plugin versions or run SQL queries to test for injection attempts via the 'erpadvancefilter' parameter.

Impact Analysis

Authenticated attackers with specific roles (CRM Agent, CRM Manager, or WordPress admin) and capabilities can exploit this to append malicious SQL queries. This could allow them to extract sensitive data from the database, potentially including user information, financial records, or other confidential data stored in the ERP system.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of sensitive personal data, which would violate GDPR and HIPAA requirements for data protection and access controls. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the plugin to the latest version beyond 1.17.4. If an update is unavailable, disable the plugin or restrict access to the 'CRM Agent' role and 'erp_crm_list_contact' capability. Review database logs for suspicious SQL queries involving the 'erpadvancefilter' parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart