CVE-2025-5956

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5956
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L48 Product
https://wordpress.org/plugins/hrm/#developers Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/28cf0f3f-0048-4da9-aa86-243479f7b974?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mishubd:wp_human_resource_management:*:*:*:*:*:wordpress:*:*
History

13 Aug 2025, 19:29

Type Values Removed Values Added
First Time Mishubd wp Human Resource Management
Mishubd
CPE cpe:2.3:a:mishubd:wp_human_resource_management:*:*:*:*:*:wordpress:*:*
References () https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L48 - () https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L48 - Product
References () https://wordpress.org/plugins/hrm/#developers - () https://wordpress.org/plugins/hrm/#developers - Release Notes
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/28cf0f3f-0048-4da9-aa86-243479f7b974?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/28cf0f3f-0048-4da9-aa86-243479f7b974?source=cve - Third Party Advisory

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) El complemento WP Human Resource Management para WordPress es vulnerable a la eliminación arbitraria de usuarios debido a la falta de autorización en la función ajax_delete_employee() en las versiones 2.0.0 a 2.2.17. El gestor de eliminación del complemento lee la matriz $_POST['delete'] proporcionada por el cliente y pasa cada ID directamente a wp_delete_user() sin verificar que el usuario tenga la capacidad delete_users ni limitar los ID de usuario que se pueden eliminar. Esto permite a atacantes autenticados, con acceso de empleado o superior, eliminar cuentas arbitrarias, incluyendo las de administrador.

04 Jul 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-04 03:15

Updated : 2025-08-13 19:29

NVD link : CVE-2025-5956

Mitre link : CVE-2025-5956

CVE.ORG link : CVE-2025-5956

JSON object : View

Products Affected

mishubd

  • wp_human_resource_management
CWE
CWE-862

Missing Authorization