Input validation vulnerability in WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting 1.6.4

The WP ERP plugin, which provides a complete HR solution with recruitment and job listings, as well as a WooCommerce CRM and accounting plugin for WordPress, is vulnerable to a security issue known as Cross-Site Request Forgery. This affects versions up to, and including, 1.6.3. The vulnerability is caused by the lack of a nonce validation on certain functions, such as handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_crm_contact. This means that if an attacker can trick a site administrator into clicking on a link, they can make changes to the plugin’s settings without being authenticated.