Arbitrary File Upload in DoubleScale CRM Plugin for WordPress

The DoubleScale CRM plugin for WordPress, in versions up to and including 1.5.1, contains a critical arbitrary file upload vulnerability. The flaw exists within the store_upload function, which is exposed via a REST API endpoint registered only when the Helpdesk module is active. The root cause is a flawed extension validation mechanism in the extension_is_allowed function. This function incorrectly validates files by relying on wp_check_filetype, which can return an empty type for unrecognized extensions such as .php, and subsequently failing open. Because the vulnerability only requires a low-privilege (subscriber) account and lacks sufficient capability checks, an attacker can upload arbitrary executable files to the web server, resulting in remote code execution (RCE). This vulnerability is tracked as CVE-2026-111311.

Impact

Successful exploitation of CVE-2026-111311 allows an authenticated attacker with at least subscriber-level permissions to execute arbitrary code on the underlying server. This could lead to a complete site compromise, data exfiltration, or lateral movement within the hosting environment. WordPress installations using the DoubleScale plugin with the Helpdesk module enabled are at high risk.

Recommendation

• Immediately update the DoubleScale CRM plugin to a version addressing CVE-2026-111311.
• Disable the Helpdesk module if it is not required for business operations to mitigate the attack surface for this vulnerability.
• Audit user roles and permissions to ensure that subscriber accounts are limited to necessary functions only.
• Monitor web server logs for POST requests to REST endpoints associated with the DoubleScale CRM plugin, particularly those resulting in file creation within the WordPress uploads directory.