{"id":"CVE-2026-111829","kind":"vulnerability","aliases":["CVE-2026-111829"],"related":[],"title":"WP Mailster WordPress plugin: PHP file inclusion flaw through version 1.9.1.0","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.","summary":"The WP Mailster WordPress plugin builds a PHP include or require path from input it does not control properly. An attacker can make the plugin load a local file, which can expose server files and may run code if the attacker can place or reach a suitable file.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-mailster"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Mailster version in the WordPress admin plugin list or in the plugin's main file header (`wp-mailster`).\n- Confirm whether the installed version is `1.9.1.0` or older.","fix":"- Update WP Mailster to a version later than `1.9.1.0`; the fixed version is unknown from the sources.\n- If no fixed version is available, deactivate the plugin until the vendor publishes one.","status":"open","published_at":"2026-10-19T14:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:57:04+00:00","updated_at":"2026-10-25T03:57:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Mailster to a version later than `1.9.1.0`; the fixed version is unknown from the sources.\n- If no fixed version is available, deactivate the plugin until the vendor publishes one.","reach":"internet","title":"WP Mailster WordPress plugin: PHP file inclusion flaw through version 1.9.1.0","impact":"medium","summary":"The WP Mailster WordPress plugin builds a PHP include or require path from input it does not control properly. An attacker can make the plugin load a local file, which can expose server files and may run code if the attacker can place or reach a suitable file.","category":"package","nicknames":[],"who_cares":["wordpress","wp-mailster","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Server files readable; code may run if a suitable file is reachable","analyst_note":"Confirm the fixed version and the request path or parameter that reaches the include at the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed WP Mailster version in the WordPress admin plugin list or in the plugin's main file header (`wp-mailster`).\n- Confirm whether the installed version is `1.9.1.0` or older.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Mailster WordPress plugin at version `1.9.1.0` or older are exposed. The sources do not say which plugin features or request paths reach the vulnerable include, so sites that do not use the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3323,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111829':14A,17A '-2026':13A,16A '1.9.1.0':11A,109C 'affect':103C 'allow':97C 'attack':46B,66B 'build':31B 'code':63B 'control':43B,75C 'cve':12A,15A 'expos':57B 'file':6A,54B,59B,73B,86C,100C 'filenam':77C 'flaw':8A 'host':21B 'improp':74C 'includ':34B 'include/require':79C 'inclus':7A,87C 'inclusion.this':101C 'input':39B 'issu':102C 'load':51B 'local':53B,99C 'mailster':2A,25B,28B,91C,93C,96C,105C 'make':48B 'may':61B 'n/a':107C 'packag':18B 'path':37B 'php':5A,33B,82C,84C,98C 'place':68B 'plugin':4A,30B,50B 'program':83C 'proper':44B 'reach':70B 'remot':85C 'requir':36B 'run':62B 'self':20B 'self-host':19B 'server':58B 'statement':80C 'suitabl':72B 'version':10A 'vulner':88C 'wordpress':3A,22B,29B 'wp':1A,24B,27B,90C,92C,95C,104C 'wp-mailster':23B,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Mailster WordPress plugin at version `1.9.1.0` or older are exposed. The sources do not say which plugin features or request paths reach the vulnerable include, so sites that do not use the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111829","severity":null,"published_at":"2026-10-19T14:17:00+00:00","modified_at":"2026-10-19T19:17:23+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}