WP ERP CVE-2026-96894

Exploitation requires the ERP plugin's inbound CRM email routing / email-sync feature to be enabled and processing incoming mail. The attacker must supply an inbound email whose References header satisfies the router's regex for a reply token; because that token's hash is never cryptographically validated, any external party who received a CRM outbound email - or who can mimic the token format - passes the gate without authentication or a WordPress account. The stored payload is passive: it only fires when an authenticated CRM user (such as an agent or administrator) opens the injected email in the timeline view. Limiting factors are therefore the non-default dependence on configured inbound email processing, the need to know or imitate a valid reply-token format, and the requirement that a logged-in CRM user subsequently view the injected record.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated stored XSS with a changed scope and limited confidentiality/integrity impact - consistent with the description, which shows the inbound email router gates only on a regex match of the References header reply token whose hash is never cryptographically validated, so no WordPress account is needed. vuln.today assigns a 'this_week' priority rather than an emergency label. No CISA KEV listing is present and no EPSS score was supplied, so widespread or confirmed active exploitation cannot be asserted; the only reporting source is Wordfence plus WordPress.org source-code references. The practical risk is a genuine, actionable unauthenticated stored XSS, but it is scoped to environments that actually run the plugin's inbound/email-sync CRM feature and depends on a logged-in CRM user later viewing the injected timeline - so it is a real this-week patching priority, not a mass-exploited internet-wide emergency, and in the absence of EPSS data the exploitation likelihood is unquantified.

An external party who previously received (or can replicate the format of) a CRM outbound email crafts an inbound reply whose References header carries a reply token matching the router's regex, and embeds a malicious script in the email body. Because the token's hash is never validated, the message is accepted and stored without a WordPress account; when a CRM agent or administrator later opens the email in the timeline view, the script executes in their authenticated browser session. No public exploit code was identified at time of analysis.