CVE-2026-18080: WooCommerce ERP Plugin RCE Vulnerability

CVE-2026-18080 Overview

CVE-2026-18080 is an unrestricted file upload vulnerability in the WP ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.17.8. The save_attachments() function fails to validate file extensions and normalize paths when the CRM Email Connect module processes inbound IMAP email attachments. Unauthenticated attackers can send a crafted email with a forged References header and a path-traversal filename such as ../helper.php. The cron-based IMAP sync job writes attacker-controlled PHP outside the protected crm-attachments directory and into wp-content/uploads/, enabling remote code execution on hosts that execute PHP in uploads.

Critical Impact
Unauthenticated remote code execution on WordPress sites running WP ERP with CRM IMAP Email Connect enabled and configured.

Affected Products

WP ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress
All versions up to and including 1.17.8
Deployments with the CRM module and IMAP Email Connect feature enabled

Discovery Timeline

2026-08-26 - CVE-2026-18080 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18080

Vulnerability Analysis

The vulnerability is classified as an Unrestricted File Type Upload flaw [CWE-434]. It resides in the save_attachments() function that handles attachments pulled from an inbound IMAP mailbox. The function does not validate the file extension of attachments and does not normalize the attachment filename before writing to disk. As a result, a filename containing ../ sequences escapes the intended crm-attachments directory, which is otherwise protected by an .htaccess file that blocks PHP execution.

By writing a .php payload into wp-content/uploads/, the attacker bypasses the directory-level execution restriction. On WordPress installations where PHP is permitted to execute within the uploads directory, requesting the dropped file triggers arbitrary PHP execution in the context of the web server.

Root Cause

The root cause is two missing controls in save_attachments(): absent file extension allowlisting and absent path normalization on IMAP-supplied filenames. Attacker-controlled input is passed directly into a filesystem write operation without sanitization.

Attack Vector

Exploitation requires the CRM module and IMAP Email Connect to be enabled and configured with an inbound mailbox. The attacker sends an email to that mailbox containing a forged References header that matches the plugin's expected pattern used to associate messages with CRM threads. The email includes an attachment whose filename embeds a traversal sequence, for example ../helper.php. When the cron-based IMAP sync job runs, the plugin writes the attachment to a location under wp-content/uploads/ outside the .htaccess-protected attachments directory. The attacker then requests the dropped file over HTTP to trigger PHP execution. No authentication or user interaction is required. Full technical details are documented in the Wordfence Vulnerability Report and the upstream fix in the WordPress Plugin Changeset.

Detection Methods for CVE-2026-18080

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present under wp-content/uploads/ or its subdirectories, particularly files with names resembling CRM attachment identifiers.
Inbound emails to the configured CRM mailbox containing attachments with filenames that include ../ sequences or non-standard executable extensions.
Web server access logs showing GET or POST requests to newly created PHP files inside wp-content/uploads/ from unfamiliar source addresses.

Detection Strategies

Perform integrity monitoring on wp-content/uploads/ and alert on creation of files with server-executable extensions.
Inspect IMAP mailbox contents and MIME attachment part names for path traversal patterns before the plugin processes them.
Correlate WordPress cron execution events with subsequent filesystem writes to detect writes made by the IMAP sync job.

Monitoring Recommendations

Log and review the WP ERP CRM Email Connect sync job output to identify attachments written with unexpected paths or extensions.
Monitor outbound network activity from the web server for beaconing that could indicate post-exploitation from a dropped webshell.
Enable web application firewall logging for requests targeting files inside wp-content/uploads/ with a .php suffix.

How to Mitigate CVE-2026-18080

Immediate Actions Required

Update the WP ERP plugin to the version that includes the fix committed in WordPress Plugin Changeset 3656848.
Audit wp-content/uploads/ for unauthorized PHP files and remove any attacker-planted payloads.
Rotate WordPress administrator credentials, API keys, and IMAP mailbox credentials on sites that were exposed.

Patch Information

The vendor addressed the vulnerability in the WP ERP plugin repository. Site operators should upgrade beyond version 1.17.8 to the patched release. Review the WordPress Plugin Changeset for the specific code changes to save_attachments(), which introduce extension validation and path normalization for IMAP attachments.

Workarounds

Disable the CRM Email Connect feature or the CRM module entirely until the plugin is updated.
Configure the web server to deny PHP execution within wp-content/uploads/ and all subdirectories.
Restrict the configured inbound IMAP mailbox to trusted senders using upstream mail filtering to limit exposure to unauthenticated attackers.

bash

# Apache: deny PHP execution in the uploads directory
# Place this in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx: deny PHP execution under uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9]+)$ {
    deny all;
    return 403;
}