The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin allows arbitrary file upload when the CRM Email Connect feature processes inbound IMAP attachments. Missing file extension validation and lack of path normalization give an attacker the ability to craft an email attachment named something like "../helper.php". The cron‑based IMAP sync job then writes the file outside the protected crm‑attachments directory, into wp-content/uploads. On installations where PHP is executed in that uploads folder, the attacker can run injected PHP code, leading to full remote code execution.

Affected systems include sites running any version of the Wedevs ERP plugin up to and including 1.17.8 on WordPress, provided the CRM module and IMAP Email Connect feature are enabled and configured. This vulnerability does not require the victim to be logged in; it relies solely on the ability to submit a crafted IMAP email to the site's inbound mailbox.

The risk level is high with a CVSS score of 9.8. Exploit probability is unknown because EPSS is not available, and the issue is not listed in the CISA KEV catalog. Given the lack of authentication requirements and the potential for immediate code execution if the uploads directory is executable, the likelihood of exploitation is elevated for sites that have left the IMAP sync feature active on a vulnerable plugin version.