CVE-2026-11421

Name of the Vulnerable Software and Affected Versions ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support versions prior to 1.17.5

Description An issue exists where authenticated attackers with the CRM Agent role, CRM Manager role, or WordPress administrator privileges, and the erp crm list contact capability, can perform SQL Injection. This occurs because the erpadvancefilter parameter is not sufficiently escaped and the corresponding SQL query is not properly prepared. The handler uses sanitize text field, which allows single quotes to persist, and the erp crm contact advance filter() function interpolates this value directly into a single-quoted SQL WHERE clause executed via $wpdb->get results(). This allows attackers to append additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 1.17.4. As a temporary mitigation, restrict access to the erpadvancefilter parameter for users with the CRM Agent role.