{"id":"CVE-2026-111832","kind":"vulnerability","aliases":["CVE-2026-111832"],"related":[],"title":"WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.","summary":"WP Mailster <= 1.9.1.0 lets an unauthenticated remote attacker upload executable files (web shells) through email attachment storage, which gives remote code execution on the WordPress server. CVSS 10.0. Fixed in 1.9.2. No exploitation reported yet, but Patchstack expects mass exploitation.","severity":"critical","cvss":10.0,"epss":0.00405,"exploited":false,"exploited_at":null,"products":[{"name":"wp-mailster","fixed":["1.9.2.0"],"affected":"<= 1.9.1.0","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["package","rce","self-hosted","unauthenticated","wordpress","wp-mailster"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin, open Plugins and check the WP Mailster version, or read the Version header in wp-content/plugins/wp-mailster/wp-mailster.php. Version 1.9.1.0 or earlier is vulnerable. Also look for unexpected .php files under the plugin's attachment or uploads directories.","fix":"Update WP Mailster to 1.9.2 (Patchstack writes it as 1.9.2.0) or later. If you cannot update, deactivate the plugin. If you find unexpected PHP files in the uploads or attachment directories, treat the site as compromised and rotate credentials.","status":"open","published_at":"2026-10-21T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:15+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:33:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells","impact":"high","summary":"The WP Mailster WordPress plugin lets users upload files of dangerous types without restriction, per NVD. An attacker who can upload a web shell to the server can run commands on the web server and read its data.","category":"package","who_cares":["wordpress","wp-mailster","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the web server and reads site data","analyst_note":"Find the patched plugin version and whether the upload endpoint requires login, via the NVD entry CVE-2026-111832 and the WordPress plugin advisory.","how_to_check":"Check whether the wp-mailster plugin is installed and its version is 1.9.1.0 or earlier, for example in the WordPress admin plugins page or wp-content/plugins/wp-mailster.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000494,"input_tokens":2929,"output_tokens":402,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the patched plugin version and whether the upload endpoint requires login, via the NVD entry CVE-2026-111832 and the WordPress plugin advisory.","search":"'-111832':14A,17A '-2026':13A,16A '1.9.1.0':33B,103C '1.9.2':61B '10.0':58B 'affect':97C 'allow':87C 'attach':46B 'attack':8A,38B 'code':51B 'cve':12A,15A 'cvss':57B 'danger':76C 'email':45B 'execut':40B,52B 'expect':68B 'exploit':63B,70B 'file':41B,74C 'fix':59B 'give':49B 'host':25B 'issu':96C 'let':7A,34B 'mailster':2A,20A,30B,32B,81C,83C,86C,99C 'mass':69B 'n/a':101C 'packag':21B 'patchstack':67B 'plant':9A 'plugin':4A 'rce':22B 'remot':37B,50B 'report':64B 'self':24B 'self-host':23B 'server':56B 'server.this':95C 'shell':11A,43B,91C 'storag':47B 'type':77C 'unauthent':26B,36B 'unrestrict':5A,71C 'upload':6A,39B,72C,88C 'vulner':78C 'web':10A,42B,90C,94C 'wordpress':3A,27B,55B 'wp':1A,19A,29B,31B,80C,82C,85C,98C 'wp-mailster':18A,28B,84C 'yet':65B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111832","severity":null,"published_at":"2026-10-21T15:17:15+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111832:313","url":null,"severity":null,"published_at":"2026-10-23T22:51:58+00:00","modified_at":"2026-10-23T22:51:58+00:00","first_seen_at":"2026-10-23T22:51:58+00:00","fetched_at":"2026-10-23T22:51:58+00:00","note":"Patchstack (reported by Peter Tang, 10 Oct 2026) lists the flaw as unauthenticated, CVSS 10 (PR:N), fixed in 1.9.2.0. The vendor changelog for v1.9.2 (18 Oct) says it hardened attachment storage against executable uploads, but it does not name the CVE. No public PoC or exploitation found; I did not search X or Bluesky. The vendor's own advisory is not found, so the Patchstack-to-changelog link is inferred."},{"source":"epss","external_id":"CVE-2026-111832","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111832","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1635,"url":"https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-9-1-0-arbitrary-file-upload-vulnerability","title":"Patchstack: WP Mailster <= 1.9.1.0 Arbitrary File Upload (unauthenticated)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1636,"url":"https://wpmailster.com/changelog/wp-mailster-v1-9-2/","title":"WP Mailster v1.9.2 changelog","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}