CVE-2026-9237

Name of the Vulnerable Software and Affected Versions Crew HRM plugin for WordPress versions prior to 1.2.3

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated users with subscriber-level access or higher can delete, archive, unarchive, and duplicate arbitrary job listings, including associated stages, meta, addresses, and applications. This is achieved by providing an arbitrary integer job id to the crewhrm singleJobAction AJAX action. The nonce verified by the Dispatcher::dispatch() function is exposed to all authenticated front-end visitors through wp head script localization, allowing low-privileged users to bypass the security check.

Recommendations Update the plugin to a version newer than 1.2.2.