PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59522 weDevs CVE debrief

A Subscriber Broken Access Control vulnerability exists in WP ERP plugin versions up to 1.17.5. This issue allows unauthorized access to sensitive data. Defenders should assess exposure, prioritize remediation, and verify inventory.

Vendor
weDevs
Product
WP ERP
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-23
Original CVE updated
2026-10-24
Advisory published
2026-07-23
Advisory updated
2026-10-24

Who should care

Defenders responsible for WP ERP plugin installations, security teams, and IT administrators should assess exposure and prioritize remediation.

Why it matters

The Subscriber Broken Access Control vulnerability in WP ERP plugin versions up to 1.17.5 requires defenders to assess exposure, prioritize remediation, and verify inventory to prevent potential unauthorized access.

  • Potential unauthorized access to sensitive data
  • Need to verify inventory of WP ERP plugin installations
  • Remediation priority for vulnerable plugin versions

Technical summary

The WP ERP plugin versions up to 1.17.5 are vulnerable to a Subscriber Broken Access Control issue, allowing unauthorized access to sensitive data.

Defensive priority

Medium priority due to potential unauthorized access

Recommended defensive actions

  • Assess exposure of WP ERP plugin versions up to 1.17.5
  • Prioritize remediation of vulnerable plugin versions
  • Verify inventory of WP ERP plugin installations

Evidence notes

The CVE record and NVD entry provide details on the Subscriber Broken Access Control vulnerability in WP ERP plugin versions up to 1.17.5.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59522 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59522

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59522 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59522

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.