CVE-2026-15349

Name of the Vulnerable Software and Affected Versions ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce versions prior to 1.17.7

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to create arbitrary company locations within the ERP database.

Recommendations Update to a version newer than 1.17.6.