---
id: "CVE-2026-111832"
kind: "vulnerability"
aliases: ["CVE-2026-111832"]
title: "WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells"
severity: "critical"
cvss: 10.0
epss: 0.00405
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-mailster", "fixed": ["1.9.2.0"], "affected": "<= 1.9.1.0", "ecosystem": "wordpress"}]
ecosystems: ["wordpress"]
tags: ["package", "rce", "self-hosted", "unauthenticated", "wordpress", "wp-mailster"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-21T15:17:15+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111832", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:51:58+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111832", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shells

WP Mailster <= 1.9.1.0 lets an unauthenticated remote attacker upload executable files (web shells) through email attachment storage, which gives remote code execution on the WordPress server. CVSS 10.0. Fixed in 1.9.2. No exploitation reported yet, but Patchstack expects mass exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-mailster affected <= 1.9.1.0 fixed 1.9.2.0

## How to check

In WordPress admin, open Plugins and check the WP Mailster version, or read the Version header in wp-content/plugins/wp-mailster/wp-mailster.php. Version 1.9.1.0 or earlier is vulnerable. Also look for unexpected .php files under the plugin's attachment or uploads directories.

## Fix

Update WP Mailster to 1.9.2 (Patchstack writes it as 1.9.2.0) or later. If you cannot update, deactivate the plugin. If you find unexpected PHP files in the uploads or attachment directories, treat the site as compromised and rotate credentials.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111832
- 2026-10-23T22:51:58+00:00 analyst — Patchstack (reported by Peter Tang, 10 Oct 2026) lists the flaw as unauthenticated, CVSS 10 (PR:N), fixed in 1.9.2.0. The vendor changelog for v1.9.2 (18 Oct) says it hardened attachment storage against executable uploads, but it does not name the CVE. No public PoC or exploitation found; I did not search X or Bluesky. The vendor's own advisory is not found, so the Patchstack-to-changelog link is inferred.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111832

## Documents

- [advisory] Patchstack: WP Mailster <= 1.9.1.0 Arbitrary File Upload (unauthenticated) https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-9-1-0-arbitrary-file-upload-vulnerability
- [fix] WP Mailster v1.9.2 changelog https://wpmailster.com/changelog/wp-mailster-v1-9-2/

## From the sources

Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_