CVE-2023-2744 (published 2023-06-27T13:17:11.163Z)
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Affected products: Vendor: Unknown
Product: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Versions: 0