What is the CVSS score of CVE-2026-27064?

CVE-2026-27064 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Mailster are affected by CVE-2026-27064?

Mailster WordPress newsletter plugin versions 4.1.17 and earlier contains a critical arbitrary file upload vulnerability (CVSS 9.1) exploitable by users with Editor-level privileges; no public…

How to fix or mitigate CVE-2026-27064?

Within 24 hours, immediately identify all WordPress installations running Mailster and verify current version; disable the plugin across all instances running version 4.1.17 or earlier, and audit user accounts with Editor privileges. Within 7 days, review access logs for suspicious file uploads or Editor activities, isolate any potentially compromised systems, and restrict Editor role assignments to only essential trusted users. Over the next 30 days, monitor vendor advisories for patched versions and deploy immediately upon release; if no patch becomes available, evaluate and implement an alternative email newsletter solution.

Mailster CVE-2026-27064

EUVD-2026-48151 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-23 Patchstack

GHSA-qwf2-rfq8-mpjg

WordPress File Upload Mailster Wordpress Plugin

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Editor-level authentication forces PR:H; upload handler is remote and low-complexity (AV:N/AC:L, no UI), and PHP web-shell execution escapes the plugin to the host (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:17 vuln.today

CVE Published

Jul 23, 2026 - 11:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.

AnalysisAI

Arbitrary file upload in the Mailster WordPress email newsletter plugin (versions 4.1.17 and earlier) lets a user with Editor-level privileges upload files of dangerous types, enabling web shell placement and remote code execution on the host. Rated CVSS 9.1 and reported by Patchstack, the flaw abuses insufficient validation in an editor-accessible upload feature; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Mailster (vendor Everpress, CPE cpe:2.3:a:everpress:mailster) is a commercial WordPress plugin for building, sending, and tracking email newsletter campaigns. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler reachable by the WordPress Editor role fails to properly validate file type/extension/content, so an attacker can write executable PHP (or otherwise dangerous) files into a web-accessible location. Because WordPress executes PHP within its document root, an uploaded script becomes directly invokable, turning a file-write primitive into server-side code execution.

RemediationAI

Upgrade Mailster to the vendor-released version that supersedes 4.1.17 (a build greater than 4.1.17); the exact patched version is not confirmed in the provided data, so verify the current fixed release directly via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mailster/vulnerability/wordpress-mailster-plugin-4-1-17-arbitrary-file-upload-vulnerability and the Everpress/Mailster changelog before deploying. Until patched, restrict who holds the Editor role and audit existing Editor accounts, since exploitation requires that privilege level (trade-off: may disrupt legitimate content editors). As additional compensating controls, deny execution of PHP within WordPress upload/media directories via web-server rules (e.g. an Nginx location or Apache <FilesMatch> that blocks .php under wp-content/uploads) - this can break plugins that legitimately execute uploaded scripts, so test first - and monitor the uploads path for newly written executable files.