Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-18080— ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment

Quick assessment

Affected
wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress ERP是WordPress基金会开源的一款企业资源计划管理软件。 WordPress ERP 1.17.8及之前版本存在任意文件上传漏洞，该漏洞源于缺少文件扩展名验证和路径规范化，可能导致未经身份验证的攻击者通过特制邮件附件上传任意文件，从而造成远程代码执行。

CVSS 9.8 · Critical EPSS 0.87% · P59

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce ≤ 1.17.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18080

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
Source: CVE Program / CVE List V5
Vulnerability Description
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress ERP 任意文件上传漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress ERP是WordPress基金会开源的一款企业资源计划管理软件。 WordPress ERP 1.17.8及之前版本存在任意文件上传漏洞，该漏洞源于缺少文件扩展名验证和路径规范化，可能导致未经身份验证的攻击者通过特制邮件附件上传任意文件，从而造成远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce 0 ~ 1.17.8 -

II. Public POCs for CVE-2026-18080

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18080

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-18080 (1)

Vendor Pages for CVE-2026-18080 (1)

IV. Related Vulnerabilities

Same product: ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Same vendor: wedevs
Same weakness: CWE-434