CVE-2026-2720 PUBLISHED

Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure

Assigner: Wordfence
Reserved: 18.02.2026 Published: 21.03.2026 Updated: 21.03.2026

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive employee information including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor codeclove
Product Hr Press Lite
Versions Default: unaffected
  • affected from * to 1.0.2 (incl.)

Credits

  • Itthidej Aramsri finder
  • Waris Damkham finder

References

Problem Types

  • CWE-862 Missing Authorization CWE