CVE-2026-18080: CWE-434 Unrestricted Upload of File with Dangerous Type in wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce

CVE-2026-18080 is a critical vulnerability in the wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin. The issue arises from the save_attachments() function lacking proper file extension validation and path normalization when handling inbound IMAP email attachments via the CRM Email Connect feature. An attacker can send a crafted email with a forged References header and a malicious attachment filename such as '../helper.php'. This causes the cron-based IMAP sync job to write attacker-controlled PHP files outside the .htaccess-protected crm-attachments directory into the wp-content/uploads/ directory. If the server executes PHP files in the uploads directory, this can lead to remote code execution. The vulnerability affects all versions up to and including 1.17.8 and requires the CRM module and IMAP Email Connect to be enabled and configured for exploitation.

Successful exploitation allows an unauthenticated attacker to upload and execute arbitrary PHP code on the affected WordPress site, leading to full remote code execution. This compromises confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the CRM module and IMAP Email Connect feature if not required. Additionally, restrict PHP execution in the wp-content/uploads/ directory as a defense-in-depth measure. Monitor vendor channels for official patches or updates addressing this vulnerability.