CVE-2026-111829
Deferred Deferred - Pending Action

Improper File Inclusion in WP Mailster

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111829
EUVD
EUVD-2026-104325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WP Mailster WP Mailster 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Remote File Inclusion vulnerability in the WP Mailster WordPress plugin versions 1.9.1.0 and earlier. It allows improper control of filenames in include/require statements, enabling attackers to load unauthorized server files. The flaw has a CVSS score of 6.5, indicating moderate risk.

Detection Guidance

Check if the WP Mailster plugin version is 1.9.1.0 or earlier. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files in the /wp-content/plugins/wp-mailster/ directory for version details.

Impact Analysis

An attacker could exploit this to load unauthorized files on the server, potentially leading to a site takeover. Exploitation requires contributor or developer-level privileges. The impact is classified as low severity but could still compromise website integrity.

Compliance Impact

This vulnerability could potentially lead to unauthorized access to sensitive files on the server, which may include personal data or protected health information. If exploited, it could result in non-compliance with GDPR or HIPAA due to unauthorized data exposure or breaches.

Mitigation Strategies

Update the WP Mailster plugin to version 1.9.2.0 or later immediately. If updating is not possible, seek help from a hosting provider or web developer to apply necessary fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart