{"id":"CVE-2026-9237","aliases":["EUVD-2026-42566","GHSA-qjph-9jxc-9pcm"],"status":"published","title":"Employee, Leave and Recruitment Management System \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action","description":"The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00394,"percentile":0.33835,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-07-09T09:31:22Z","modified":"2026-07-09T18:16:58Z","products":[{"vendor":"crewhrm","product":"employee, leave and recruitment management system – crew hrm"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be30e951-7c8d-4baf-9288-0d12dacc0dc2?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Controllers/JobManagement.php#L151"},{"url":"https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Controllers/JobManagement.php#L29"},{"url":"https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Setup/Dispatcher.php#L123"},{"url":"https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Models/User.php#L73"},{"url":"https://plugins.trac.wordpress.org/browser/hr-management/tags/1.2.2/classes/Setup/Dispatcher.php#L139"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3556031%40hr-management\u0026new=3556031%40hr-management"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9237"},{"url":"https://github.com/advisories/GHSA-qjph-9jxc-9pcm"}],"sources":{"cve":[{"id":"CVE-2026-9237","title":"Employee, Leave and Recruitment Management System \u003c= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action","description":"The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.","status":"published","published":"2026-07-09T09:31:22.661Z","modified":"2026-07-09T17:21:17.258Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-42566","description":"The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.","status":"published","published":"2026-07-09T09:31:22Z","modified":"2026-07-09T17:21:17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"ghsa":[{"id":"GHSA-qjph-9jxc-9pcm","title":"The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is...","description":"The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.","status":"published","published":"2026-07-09T12:30:28Z","modified":"2026-07-09T12:30:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:09:21.623271Z"}],"nvd":[{"id":"CVE-2026-9237","description":"The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.","status":"published","published":"2026-07-09T11:16:42.37Z","modified":"2026-07-09T18:16:58.397Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:28.4135Z"}]}}