Security Alert Summary
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin contains an unrestricted file type upload vulnerability (CVE-2026-18080) in its CRM Email Connect IMAP processing. An unauthenticated attacker can craft an email with a specially formed References header and a path-traversal attachment filename to cause the plugin’s cron-based IMAP sync to write attacker-controlled PHP into the sites uploads directory, which can lead to remote code execution on configurations where PHP is executable in uploads. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
CVE Details
- CVE ID: CVE-2026-18080
- Affected component: ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin (CRM Email Connect inbound IMAP attachment handling)
- Affected versions: All versions up to and including 1.17.8
- Published: August 26, 2026 at 11:16:37 AM UTC
- Last modified: August 26, 2026 at 4:19:05 PM UTC
- CVSS v3.1 base score: 9.8
- CVSS v3.1 severity: CRITICAL
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User interaction:
- Authentication: none
- Privileges required: none
- User interaction: none
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability is caused by missing file extension validation and missing path normalization in the plugin’s handling of inbound IMAP email attachments. Specifically, the issue exists in the save_attachments() function used by the CRM Email Connect IMAP processor. When processing an inbound email, the plugin expects a References header matching an internal pattern. An attacker can send an email with a forged References header and an attachment filename containing path traversal (for example, ../helper.php).
Because the plugin does not properly normalize the path or validate the attachment filename and extension, the cron-based IMAP sync job can write the attachment outside of the plugins .htaccess-protected crm-attachments directory and into wp-content/uploads/. On systems where PHP files can be executed from the uploads directory, an attacker-controlled PHP file placed there may be executed, resulting in remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured; otherwise the IMAP processing path is not active.
How This Could Impact Your Website
Consider a typical small business WordPress site where the site owner has enabled the ERP plugin and configured inbound IMAP processing for CRM email. Internal staff or external contractors may expect that inbound attachments are handled safely. An attacker who can send email to the configured mailbox could place a crafted attachment that ends up written into the public uploads area. The practical consequences include exposure of internal email-based workflows and, on susceptible server configurations, the possibility of attacker-supplied PHP being executed.
In a realistic scenario, an attacker could target specific employees by sending messages to the inbound mailbox with crafted attachments; this might expose internal email addresses or enable follow-on attacks such as targeted phishing or social engineering. The primary risk is unauthorized code execution or file modification arising from unsafe attachment handling, rather than direct compromise of user passwords. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Apply updates for the affected plugin as soon as a fixed version is made available.
- Disable the CRM Email Connect inbound IMAP feature or the CRM module if you do not use it, until a patch is applied.
- Review and reduce unnecessary user roles and minimize privileges for contributors and other non-admin accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor uploads and site activity for unusual file writes or unexpected PHP files in
wp-content/uploads/.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
