CVE-2025-30896: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in weDevs WP ERP plugin affecting versions through 1.13.4. The vulnerability was disclosed on March 27, 2025, and is tracked as CVE-2025-30896. This security issue allows exploiting incorrectly configured access control security levels in the WordPress plugin (Patchstack).

The vulnerability is classified as a broken access control issue, which refers to a missing authorization, authentication, or nonce token check in a function that could allow an unprivileged user to execute certain higher privileged actions. The vulnerability has been assigned a CVSS v3.1 score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (NVD).

The vulnerability has a low severity impact and requires subscriber-level privileges to exploit. It could potentially allow unauthorized users to perform actions beyond their intended permission level (Patchstack).

The vulnerability has been fixed in version 1.14.0 of the WP ERP plugin. Users are advised to update to version 1.14.0 or later to remove the vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).