CVE-2026-2720

The Hr Press Lite plugin for WordPress, in versions up to and including 1.0.2, is vulnerable to unauthorized access of sensitive employee data due to a missing capability check in its hrp-fetch-employees AJAX action. This flaw allows authenticated users with Subscriber-level access or higher to retrieve confidential employee information, including names, email addresses, phone numbers, and salary details. Rated with a CVSS score of 6.5 (Medium), the vulnerability has a low attack complexity and can be exploited over the network, leading to high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code availability, or significant community discussion regarding this CVE.