WP ERP CVE-2026-18080

Exploitation requires the WP ERP CRM module AND the IMAP Email Connect (inbound email sync) feature to be enabled and configured with a reachable mailbox - this is not a default WordPress or default-plugin state. The attacker must send an email whose References header is forged to match the plugin's expected pattern and whose attachment filename contains a path-traversal sequence (e.g. '../helper.php'). Successful remote code execution additionally requires the web server to be configured to execute PHP within wp-content/uploads/; on deployments that block PHP execution in uploads, the traversal write still succeeds but code execution does not. No authentication is required (PR:N) and no victim user interaction is needed; the limiting factors are the non-default feature enablement, the crafted References-header requirement, and the PHP-in-uploads execution condition.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 and describes a network-reachable, low-complexity, unauthenticated path with full confidentiality, integrity, and availability impact, which is consistent with the described attack: an attacker merely emails the site's configured inbound mailbox. Two factors meaningfully reduce real-world exposure below what the raw 9.8 suggests: exploitation requires the optional CRM module and IMAP Email Connect feature to be enabled and configured (a non-default deployment), and it further requires the host to execute PHP from wp-content/uploads/, which hardened configurations block. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization at this time; the 9.8 is a capability score, not an in-the-wild signal. Any operator running the CRM email-ingestion feature should nonetheless treat this as urgent, because the attack is unauthenticated and requires no user interaction once the feature is live. Note a caveat: the CVSS 'attack complexity: low' rating arguably understates the requirement to forge a References header matching the plugin's expected pattern, which is a minor prerequisite an attacker must satisfy.

An attacker sends a crafted email to the site's configured inbound CRM mailbox, setting a forged References header that matches the plugin's expected pattern and attaching a file named '../helper.php' containing PHP code. The next cron-based IMAP sync job invokes save_attachments(), which writes the payload into wp-content/uploads/ instead of the protected crm-attachments directory; on a server that executes PHP from uploads, the attacker then requests the file to run arbitrary code. No public POC is identified at this time, and the network attack vector with low complexity makes the scenario straightforward once the feature is enabled.