CVE-2026-18080
Deferred Deferred - Pending Action

Unrestricted File Upload in ERP Suite for WooCommerce

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Wordfence

Description
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-18080
EUVD
EUVD-2026-66408

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence the_erp_complete_hr_accounting_crm_suite_built_for_woocommerce to 1.17.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file type upload flaw in the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin. It allows unauthenticated attackers to upload malicious PHP files via crafted emails. The issue occurs because the plugin fails to validate file extensions and normalize paths when processing email attachments through the IMAP Email Connect feature. Attackers can exploit this to execute remote code on the server if PHP runs in the uploads directory.

Detection Guidance

Check if the ERP plugin is installed and verify its version. Look for unexpected PHP files in wp-content/uploads/ or crm-attachments directories. Review IMAP email sync logs for suspicious attachments or forged References headers.

Impact Analysis

This vulnerability can lead to complete server compromise. Attackers could gain full control over your WordPress site and potentially the underlying server. Sensitive data like user credentials, financial records, or customer information could be stolen or manipulated. The attack requires minimal prerequisites: the CRM module and IMAP Email Connect feature must be enabled and configured.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA. Unauthorized code execution may lead to data breaches exposing personal or health information. GDPR requires protecting personal data and reporting breaches within 72 hours. HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage for affected organizations.

Mitigation Strategies

Update the ERP plugin to the latest version. Disable the IMAP Email Connect feature if not needed. Restrict PHP execution in uploads directories. Monitor for unauthorized file uploads or unusual cron job activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart