CVE-2024-12812: 
WordPress vulnerability analysis and mitigation

The WP ERP WordPress plugin (Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting) versions before 1.13.4 contains an access control vulnerability identified as CVE-2024-12812. The vulnerability was discovered by Pedro Cuco (Illex) and was publicly disclosed on December 19, 2024 (WPScan).

The vulnerability allows active employees to manipulate URL parameters to access the data of terminated employees. This is achieved by modifying the 'id' parameter in the employee profile URL within the 'People > Employees' section of the plugin. The issue is classified as an Access Controls vulnerability (CWE-284) with a CVSS score of 7.5 (HIGH) (WPScan, Wiz).

When exploited, this vulnerability allows active employees to view confidential information of terminated employees, potentially exposing sensitive personnel data. The vulnerability falls under the OWASP Top 10 category A5: Broken Access Control (WPScan).

The vulnerability has been patched in version 1.13.4 of the WP ERP plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).