An issue exists where authenticated attackers with the CRM Agent role, CRM Manager role, or WordPress administrator privileges, and the `erp crm list contact` capability, can perform SQL Injection. This occurs because the `erpadvancefilter` parameter is not sufficiently escaped and the corresponding SQL query is not properly prepared. The handler uses `sanitize text field`, which allows single quotes to persist, and the `erp crm contact advance filter()` function interpolates this value directly into a single-quoted SQL WHERE clause executed via `$wpdb->get results()`. This allows attackers to append additional SQL queries to extract sensitive information from the database.