WP ERP inbound email attachments permit unauthenticated PHP upload
WP ERP through 1.17.8 fails to validate attachment extensions and normalize paths when CRM Email Connect processes inbound IMAP mail. An unauthenticated attacker can send a crafted message whose References header matches the expected pattern and whose attachment name traverses outside the protected crm-attachments directory, causing the cron sync to write attacker-controlled PHP into uploads. Code execution is possible where PHP runs from uploads; CRM and IMAP Email Connect must be enabled and configured.
- Component
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- Plugin slug
erp- Affected
- <= 1.17.8
- Safe version
- See mitigation notes
- Published
- Aug 26, 2026
This CVE was published Aug 26, 2026 and is one of 19 known issues for this plugin.
Update, patch or deactivate.
This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. The author guidance conflicts with the authoritative affected-version boundary; no safe version is asserted until that conflict is resolved. Disable the affected feature or component where practical until remediation for the deployed configuration is established. disable IMAP Email Connect when warranted, block PHP execution in uploads, and inspect inbound mail attachments and uploaded PHP files. Official author release notes: https://wordpress.org/plugins/erp/.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H