CVE-2026-18080: ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the saveattachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as ../helper.php, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected crm-attachments directory and into wp-content/uploads/. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerceto a version that resolves this vulnerability.Fixed in 1.17.8
Event History
Frequently Asked Questions
Which sites are exposed to remote code execution?
Exposure requires the CRM module and IMAP Email Connect feature to be enabled and configured with an inbound mailbox. Remote code execution additionally depends on the server executing PHP files from the WordPress uploads directory.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to send a crafted email to the configured inbound mailbox with a forged References header matching the plugin's expected pattern and a malicious attachment filename such as ../helper.php.
Are default plugin installations affected?
The vulnerable code is present in versions through 1.17.8, but exploitation requires the optional CRM and IMAP Email Connect functionality to be enabled and configured. Sites without that configured inbound-email processing path do not meet the stated exploitation prerequisites.
What can be done if updating is not immediately possible?
Disable the CRM Email Connect IMAP feature or prevent the plugin from processing the configured inbound mailbox. Configure the web server so PHP cannot execute from wp-content/uploads/ to reduce the remote-code-execution impact.
How can administrators look for possible exploitation?
Inspect wp-content/uploads/ for unexpected PHP files, particularly files created by the IMAP sync process or with suspicious names. Review the configured inbound mailbox and IMAP sync activity for crafted messages carrying attachment filenames with path-traversal sequences such as ../.