CVE-2026-13011

Name of the Vulnerable Software and Affected Versions ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support versions prior to 1.17.6

Description This issue is a generic SQL Injection, which occurs when an attacker can interfere with the queries that an application makes to its database. Authenticated attackers with custom-level access and above can append additional SQL queries to existing ones to extract sensitive information from the database. This is possible due to insufficient escaping of user-supplied input and a lack of sufficient preparation of the SQL query. Exploitation requires the erp list employee capability, typically granted to HR Manager-level users and above. The vulnerability is triggered via the orderby parameter.

Recommendations Update the plugin to version 1.17.6 or later. As a temporary mitigation, restrict access to the orderby parameter for users with HR Manager-level permissions or lower.