Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Home / Threats / CVE-2024-0956

CVE-2024-0956 - Accounting Plugin

CVE-2024-0956

Vulnerability CVE-2024-0956 PLUGIN accounting HIGH

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin or accounting manager privileges, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2024-0956

HIGH CVSS 7.2 Published 2024-03-29 Updated 2025-01-30
AI Risk Elevated (74/100) Active Exploit: No strong signal Published Exploit: No public exploit references Priority: P3 Priority
Severity Band HIGH
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Components 2
Reference Links 2
AI Risk Engine Elevated (74/100)
Exploitability High
Active Exploitation No strong signal
Published Exploit Status No public exploit references

Threat Timeline

  1. 2024-03-29 CVE published and first recorded in the threat feed.
  2. 2025-01-30 Record updated with latest vulnerability metadata.
  3. 2026-04-09 AI technical context refreshed for mitigation and impact guidance.
  4. Now Monitoring for follow-up changes, linked references, and new related CVEs.

AI Context

Machine-generated threat intelligence

AI Updated 7 days ago

AI enriched 7 days ago (2026-04-09 10:11 UTC)

Technical Summary

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin or accounting manager privileges, to append additional SQL queries…

Potential Impact

Severity is HIGH (CVSS 7.2). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.

Exploitability Assessment

Exploitability is assessed as High based on remote code execution potential.

Primary risk drivers: remote code execution potential

Mitigation Recommendations

Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.

Detection & Monitoring

Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.

Business Impact Lens

Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.

Affected Products

Accounting PLUGIN · accounting Affected range not specified Fixed version not specified
Wp Erp PLUGIN · wp-erp Affected: <= 1.12.9 Fixed version not specified

Related Vulnerabilities

Browse All Threats

Newest linked vulnerabilities to keep visitors exploring adjacent CVE coverage.

CVE-2024-12812 - Accounting Plugin CVE-2024-12812 Published 2025-05-15 CVE-2024-12808 - Accounting Plugin CVE-2024-12808 Published 2025-05-15 CVE-2024-1173 - Accounting Plugin CVE-2024-1173 Published 2024-05-02 CVE-2024-0952 - Accounting Plugin CVE-2024-0952 Published 2024-04-09 CVE-2024-0913 - Accounting Plugin CVE-2024-0913 Published 2024-03-29 CVE-2024-0608 - Accounting Plugin CVE-2024-0608 Published 2024-03-29
Scroll to top