CVE-2026-111311
Received Received - Intake

Arbitrary File Upload in DoubleScale CRM WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111311
EUVD
EUVD-2026-102820

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
samuelgallegos DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The DoubleScale CRM plugin for WordPress has an arbitrary file upload vulnerability in versions up to 1.5.1. The flaw is in the store_upload function due to a weak extension check that allows unrecognized files like .php to bypass restrictions. It uses only magic-byte MIME detection and lacks proper user capability checks. Authenticated attackers with subscriber-level access can exploit this to upload executable files, enabling remote code execution. The Helpdesk module must be enabled for the vulnerable endpoint to be active.

Detection Guidance

Check for unauthorized file uploads in the WordPress uploads directory, particularly PHP files in the Helpdesk module directory. Review server logs for POST requests to /wp-json/doublescale/v1/store_upload. Inspect user accounts with subscriber-level access or higher for unusual activity.

Impact Analysis

An attacker could upload malicious files to your WordPress site, gaining control over it. This could lead to data theft, defacement, or further attacks on your server. The impact includes potential compromise of sensitive data, unauthorized access, and disruption of services. The high CVSS score (8.8) indicates severe risk requiring immediate attention.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, and reputational damage. Organizations must address this flaw to maintain regulatory compliance and protect sensitive user data.

Mitigation Strategies

Update the DoubleScale plugin to the latest version if available. Disable the Helpdesk module if not needed. Remove write permissions for non-admin users in the uploads directory. Monitor for suspicious file uploads and block known malicious extensions at the server level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111311. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart