CVE-2026-111832

Deferred Deferred - Pending Action

Unrestricted File Upload in WP Mailster

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: Patchstack

Description

Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-111832

EUVD

EUVD-2026-107282

Affected Vendors & Products

Vendor	Product	Version / Range
WP Mailster	WP Mailster	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is an Unrestricted Upload of File with Dangerous Type flaw in the WP Mailster WordPress plugin versions up to 1.9.1.0. It allows attackers to upload malicious files, such as web shells, to the server. This can lead to complete website takeover if exploited.

Detection Guidance

Check if the WP Mailster plugin version is 1.9.1.0 or earlier. Look for unexpected file uploads in the server's upload directory, particularly files with extensions like .php, .jsp, or .asp. Review server logs for unusual POST requests to /wp-admin/admin-ajax.php or similar endpoints.

Impact Analysis

Attackers could upload malicious files to your server, gaining full control over your website. This may result in data theft, defacement, or use of your site for further attacks. The high CVSS score of 10 indicates widespread exploitation potential.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the WP Mailster plugin to version 1.9.2.0 or later immediately. If updating is not possible, disable the plugin temporarily and implement a web application firewall rule to block file uploads with dangerous extensions. Remove any suspicious files uploaded to the server.

Hi! I’m here to help you understand CVE-2026-111832. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...