By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite = 1.17.7 未认证的任意文件上传，通过 CRM 邮件连接 IMAP 附件（路径遍历 → RCE）...

CVE-2026-18080

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin (versions ≤ 1.17.8) is vulnerable to an unauthenticated arbitrary file upload via the CRM Email Connect IMAP attachment processing. The root cause is missing file extension validation and path normalization in the...

WordPress ERP plugin <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment vulnerability

Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment vulnerability discovered by Talal Nasraddeen in WordPress Plugin WP ERP versions = 1.17.8...