{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wp-mailster/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp-mailster:wp-mailster:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-111832"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Mailster (\u003c= 1.9.1.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","rce","file-upload"],"_cs_type":"advisory","_cs_vendors":["WP Mailster"],"content_html":"\u003cp\u003eCVE-2026-111832 is an unrestricted file upload vulnerability in the WP Mailster plugin. The flaw allows an attacker to upload arbitrary files, including web shells, which can then be executed by the web server to gain remote code execution. No vendor patch or remediation path is currently specified in the source.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full remote code execution on the underlying web server, providing the attacker with the ability to run arbitrary system commands, access files, and potentially escalate privileges within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the WP Mailster plugin to determine the current version.\u003c/li\u003e\n\u003cli\u003eRestrict access to administrative or file-uploading endpoints associated with the WP Mailster plugin using WAF rules or network segmentation until a vendor-supplied patch is applied.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests to plugin directories or suspicious file extensions (e.g., .php, .php5, .phtml) being created in upload directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T16:08:22Z","date_published":"2026-10-21T16:08:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-mailster-rce/","summary":"WP Mailster versions through 1.9.1.0 contain an unrestricted file upload vulnerability that allows remote attackers to upload web shells and achieve remote code execution.","title":"WP Mailster: Unrestricted file upload remote code execution (CVE-2026-111832)","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-mailster-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - WP Mailster","version":"https://jsonfeed.org/version/1.1"}