{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111311/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:doublescale:all-in-one_crm:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-111311"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP \u0026 More"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","rce","file-upload","cve-2026-111311"],"_cs_type":"advisory","_cs_vendors":["DoubleScale"],"content_html":"\u003cp\u003eThe DoubleScale CRM plugin for WordPress, in versions up to and including 1.5.1, contains a critical arbitrary file upload vulnerability. The flaw exists within the store_upload function, which is exposed via a REST API endpoint registered only when the Helpdesk module is active. The root cause is a flawed extension validation mechanism in the extension_is_allowed function. This function incorrectly validates files by relying on wp_check_filetype, which can return an empty type for unrecognized extensions such as .php, and subsequently failing open. Because the vulnerability only requires a low-privilege (subscriber) account and lacks sufficient capability checks, an attacker can upload arbitrary executable files to the web server, resulting in remote code execution (RCE). This vulnerability is tracked as CVE-2026-111311.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-111311 allows an authenticated attacker with at least subscriber-level permissions to execute arbitrary code on the underlying server. This could lead to a complete site compromise, data exfiltration, or lateral movement within the hosting environment. WordPress installations using the DoubleScale plugin with the Helpdesk module enabled are at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the DoubleScale CRM plugin to a version addressing CVE-2026-111311.\u003c/li\u003e\n\u003cli\u003eDisable the Helpdesk module if it is not required for business operations to mitigate the attack surface for this vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit user roles and permissions to ensure that subscriber accounts are limited to necessary functions only.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for POST requests to REST endpoints associated with the DoubleScale CRM plugin, particularly those resulting in file creation within the WordPress uploads directory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T10:25:56Z","date_published":"2026-10-16T10:25:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-doublescale-crm-rce/","summary":"An arbitrary file upload vulnerability in the DoubleScale CRM plugin for WordPress up to version 1.5.1 allows authenticated subscribers to achieve remote code execution when the Helpdesk module is enabled.","title":"Arbitrary File Upload in DoubleScale CRM Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-10-doublescale-crm-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111311","version":"https://jsonfeed.org/version/1.1"}