WP Mailster: Unrestricted file upload remote code execution (CVE-2026-111832)
WP Mailster versions through 1.9.1.0 contain an unrestricted file upload vulnerability that allows remote attackers to upload web shells and achieve remote code execution.
CVE search metadata
CVE search record: CVE-2026-111832. Severity: critical. CVSS: 10.0. KEV: no. Product: WP Mailster (<= 1.9.1.0). Brief: WP Mailster: Unrestricted file upload remote code execution (CVE-2026-111832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wp-mailster-rce/
Triage facts
Revision 1- Applicability
- WP Mailster (<= 1.9.1.0)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 16:08 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-111832 is an unrestricted file upload vulnerability in the WP Mailster plugin. The flaw allows an attacker to upload arbitrary files, including web shells, which can then be executed by the web server to gain remote code execution. No vendor patch or remediation path is currently specified in the source.
Impact
Successful exploitation allows for full remote code execution on the underlying web server, providing the attacker with the ability to run arbitrary system commands, access files, and potentially escalate privileges within the environment.
Recommendation
- Inventory all WordPress instances running the WP Mailster plugin to determine the current version.
- Restrict access to administrative or file-uploading endpoints associated with the WP Mailster plugin using WAF rules or network segmentation until a vendor-supplied patch is applied.
- Monitor web server access logs for anomalous POST requests to plugin directories or suspicious file extensions (e.g., .php, .php5, .phtml) being created in upload directories.
Immediate actions
Inventory WP Mailster plugin versions and disable affected instances
Threat Hunt
Anomalous file creation in WordPress upload directories
Data: File system events, Web server access logs