CVE-2025-5956
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
| CWE | CWE-862 |
| Vendor | asaquzzaman |
| Product | wp human resource management |
| Published | Jul 4, 2025 |
| Last Updated | Jul 8, 2025 |
Stay Ahead of the Next One
Get instant alerts for asaquzzaman wp human resource management
Be the first to know when new medium vulnerabilities affecting asaquzzaman wp human resource management are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
asaquzzaman / WP Human Resource Management
2.0.0 ≤ 2.2.17
References
Credits
Kenneth Dunn