Description

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T11:16:37.930Z",
  "pubdate": "2026-08-26T11:16:37.930Z",
  "executiveSummary": "The ERP: Complete HR, Accounting & CRM Suite for WordPress is vulnerable to an Unrestricted File Type Upload vulnerability, potentially leading to Remote Code Execution (RCE).\nThe flaw resides in the save_attachments() function within the CRM Email Connect component, which fails to validate file extensions or normalize file paths during IMAP attachment processing.\nUnauthenticated attackers can exploit this by sending a crafted email with a manipulated attachment filename, such as '../helper.php', to the configured inbound mailbox.\nThis allows the system to write arbitrary PHP code outside of the intended, protected storage directory and into the web-accessible 'wp-content/uploads/' directory.\nExploitation is contingent upon the CRM module and the IMAP Email Connect feature being active and configured.\nSuccessful exploitation allows an attacker to execute arbitrary code on the server, posing a critical risk to the confidentiality, integrity, and availability of the entire WordPress installation.",
  "technicalDetails": "The vulnerability is rooted in the improper implementation of the save_attachments() function within the CRM Email Connect module of the ERP: Complete HR, Accounting & CRM Suite plugin. Specifically, the component lacks sufficient input sanitization regarding file extensions and fails to normalize destination file paths during the processing of attachments retrieved via IMAP.\nThe attack flow initiates when an unauthenticated attacker transmits a specially crafted email to an IMAP mailbox monitored by the plugin. The attacker must incorporate a 'References' header that conforms to the expected pattern required by the plugin to trigger the CRM's attachment processing logic.\nThe payload consists of a maliciously crafted attachment with a filename string containing directory traversal characters, for example, '../helper.php'. Because the plugin does not enforce path normalization, the application incorrectly interprets the traversal sequences and resolves the file path outside of the designated 'crm-attachments' directory, which is typically secured by an .htaccess configuration file to prevent direct script execution.\nInstead, the file is written to the 'wp-content/uploads/' directory. If the server environment is configured to allow the execution of PHP scripts within the uploads directory, the attacker can achieve remote code execution by directly accessing the uploaded file via an HTTP request.\nThe vulnerability affects all versions of the ERP: Complete HR, Accounting & CRM Suite plugin up to and including 1.17.8. The process is automated through the plugin's cron-based IMAP synchronization job, which executes the vulnerable save_attachments() logic upon identifying the forged email.\nPost-exploitation, the attacker gains the ability to execute arbitrary PHP code within the context of the web server user. This level of access typically leads to complete site compromise, including the ability to read sensitive data, modify database contents, install backdoors, or pivot into the underlying server infrastructure, depending on existing system-level permissions."
}