How do I check whether I am affected by CVE-2026-111832?

In WordPress admin, open Plugins and check the WP Mailster version, or read the Version header in wp-content/plugins/wp-mailster/wp-mailster.php. Version 1.9.1.0 or earlier is vulnerable. Also look for unexpected .php files under the plugin's attachment or uploads directories.

What is the fix for CVE-2026-111832?

Update WP Mailster to 1.9.2 (Patchstack writes it as 1.9.2.0) or later. If you cannot update, deactivate the plugin. If you find unexpected PHP files in the uploads or attachment directories, treat the site as compromised and rotate credentials.

Who is not affected by CVE-2026-111832?

Not affected if: plugin-not-installed.

Live › vulnerability › CVE-2026-111832

Go to dashboard

critical10.0Packagewordpress

WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells

WP Mailster <= 1.9.1.0 lets an unauthenticated remote attacker upload executable files (web shells) through email attachment storage, which gives remote code execution on the WordPress server. CVSS 10.0. Fixed in 1.9.2. No exploitation reported yet, but Patchstack expects mass exploitation.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

10.0

critical

scored by [email protected]

known so far6 of 6

First public: Oct 21, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs code on the web server and reads site data.
CVSS said: 10.0. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-111832

Go to dashboard

critical10.0Packagewordpress

WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

10.0

critical

scored by [email protected]

known so far6 of 6

First public: Oct 21, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs code on the web server and reads site data.
CVSS said: 10.0. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources