CVE-2026-11421 in ERP Complete HR, Accounting & CRM Suite Built for WooCommerce Plugin
Summary
by MITRE • 08/05/2026
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerable ERP plugin represents a critical security flaw in the WordPress ecosystem that exploits a fundamental weakness in input validation and query construction. This vulnerability exists within the Complete HR, Accounting & CRM Suite plugin version 1.17.4 and earlier, where the developers failed to implement proper SQL query sanitization measures for user-supplied parameters. The specific parameter 'erpadvancefilter' serves as the attack vector, allowing malicious actors to inject arbitrary SQL commands into the database layer through a seemingly benign interface element.
The technical exploitation occurs due to insufficient escaping mechanisms within the plugin's codebase, specifically when processing the 'erpadvancefilter' input through the sanitize_text_field function. This WordPress sanitization routine, while designed to prevent XSS attacks, fails to adequately neutralize SQL injection threats as it preserves single quotes that are essential for SQL command construction. The vulnerability stems from the improper handling of user input where the sanitized value is directly interpolated into a single-quoted SQL WHERE clause without proper parameterization, creating an environment ripe for malicious query injection.
The operational impact of this vulnerability extends beyond simple data theft, as authenticated attackers with CRM Agent privileges or higher can construct complex SQL queries that bypass normal access controls and extract sensitive information from the database. The affected capability 'erp_crm_list_contact' provides sufficient permissions for exploitation, allowing threat actors to perform unauthorized data enumeration, potentially accessing confidential customer records, employee information, financial data, and other sensitive business assets. This represents a significant escalation from typical WordPress vulnerabilities, as it leverages existing user privileges to achieve unauthorized database access.
The vulnerability aligns with CWE-89, which specifically addresses SQL injection flaws where untrusted data is incorporated into SQL commands without proper escaping or parameterization. From an attack framework perspective, this weakness maps directly to ATT&CK technique T1071.004 for application layer protocol manipulation and T1566 for credential harvesting through social engineering attacks that may exploit such vulnerabilities. The exploitation requires minimal technical skill beyond understanding basic SQL injection concepts and leveraging existing WordPress user permissions. Organizations should implement immediate mitigations including plugin updates to versions 1.17.5 or later, which contain proper parameterization of SQL queries, along with network-level monitoring for suspicious database access patterns and enhanced privilege controls for CRM roles.
The broader implications of this vulnerability highlight the critical importance of secure coding practices in WordPress plugin development, particularly regarding database query construction and input validation. The flaw demonstrates how common sanitization functions may provide false security when applied in contexts where more robust SQL parameterization is required, emphasizing the need for developers to understand the specific threats associated with different data handling scenarios. Security teams should conduct comprehensive audits of all installed plugins to identify similar vulnerabilities that may exist in third-party WordPress solutions, as this type of issue frequently occurs in enterprise-level applications where multiple interconnected systems create extended attack surfaces.