WP Mailster CVE-2026-111832

Exploitation requires that the target run the WP Mailster plugin at version 1.9.1.0 or earlier and that the vulnerable file-upload feature be reachable by the attacker. The flaw is an unrestricted upload of a dangerous file type (CWE-434), so the practical prerequisite is the ability to invoke the plugin's upload handler and place an executable (e.g., PHP) file into a web-accessible directory. LIMITING FACTORS: the single reference does not specify which upload endpoint or capability is involved, and while the CVSS vector asserts PR:N (no authentication), file-upload flaws in WordPress plugins commonly require at least a low-privileged authenticated role - defenders should confirm whether an authenticated session is actually needed, as that materially changes real-world exposure. No special non-default configuration is documented as required.

This is a CWE-434 unrestricted file upload in the WP Mailster WordPress plugin (versions through 1.9.1.0) allowing upload of a web shell, which maps directly to full remote code execution. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) describes a maximally severe, network-reachable, no-privilege, no-interaction flaw - if accurate, this is a genuine high priority. However, several corroborating signals are MISSING: no EPSS score, no CISA KEV listing, and no POC were provided, so there is no public evidence of active or imminent exploitation yet. CONFLICT TO VERIFY: Patchstack-sourced WordPress plugin upload flaws frequently require at least a low-privileged authenticated session (e.g., subscriber/contributor), yet the vector states PR:N (fully unauthenticated); this authentication claim cannot be independently confirmed from the single reference and should be verified against the Patchstack advisory. Overall, treat this as a high-impact, prioritize-for-patching issue on the basis of impact and ease of exploitation, while recognizing that real-world exploitation probability is currently unquantified and the unauthenticated nature is unverified.

A remote attacker locates a WordPress site running WP Mailster ≤1.9.1.0 and abuses the plugin's file-upload functionality to send a crafted request containing a malicious PHP file disguised or lacking proper type/extension validation. The server stores the file in a web-accessible path, and the attacker then browses to it to execute the web shell, gaining arbitrary code execution. No public exploit code was identified at the time of analysis, so this scenario is derived from the CWE-434 classification and the AV:N/AC:L/UI:N vector rather than an observed POC.