crewhrm vulnerabilities

Products

• crewhrm 1
• Employee, Leave and Recruitment Management System – Crew HRM 1

Latest crewhrm CVEs

Newest publication first

1. CVE-2026-9237 Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action

   Published 2026-07-09

   Medium·CVSS 4.3 EPSS 0.39%

   The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

2. CVE-2024-43252 WordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerability

   Published 2024-08-19

   Critical·CVSS 9.0 EPSS 0.44%

   Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.