CVE-2026-9237: Crewhrm Employee, Leave And Recruitment Management System – Crew Hrm

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete, archive, unarchive, and duplicate arbitrary job listings — along with their associated stages, meta, addresses, and applications — by supplying an arbitrary integer job_id. The nonce verified by Dispatcher::dispatch() is exposed to all authenticated front-end visitors via wp_head script localization, meaning subscribers can trivially obtain it and satisfy the nonce check without possessing any elevated privilege.

Affected products

• Crewhrm Employee, Leave And Recruitment Management System – Crew Hrm: up to and including 1.2.2

Published 2026-07-09. Last modified 2026-07-09.