Executive brief
The ERP Suite WordPress plugin, which provides integrated HR, accounting, and customer management features, is vulnerable to file upload attacks via its email attachment processing. An attacker can send a specially crafted email to trigger the automatic IMAP sync process to write malicious PHP files to a web-accessible location, potentially enabling remote code execution and complete compromise of the affected WordPress site.
Technical details
The vulnerability is an unrestricted file type upload with path traversal (CWE-434 + CWE-22) in the save_attachments() function used by CRM Email Connect. The root cause is missing file extension validation and path normalization when processing IMAP email attachments. An unauthenticated attacker can send a crafted email with a forged References header matching the plugin's expected pattern and a malicious filename such as ../helper.php to the configured inbound mailbox. When the cron-based IMAP sync job processes the email, the attacker-controlled file is written outside the protected crm-attachments directory into wp-content/uploads/. On configurations where PHP execution is enabled in the uploads directory, this results in arbitrary code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
Affected products
- WP ERP ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce up to and including 1.17.8
Timeline
- 2026-08-26: disclosed