DoubleScale CRM EUVD-2026-102820

Two concrete prerequisites must both hold: (1) the plugin's Helpdesk module must be enabled, because the vulnerable REST endpoint that invokes store_upload is only registered when that module is active; and (2) the attacker must have an authenticated account at subscriber level or above, since the only access control is is_user_logged_in() with no capability check. The core weakness is a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() returns an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection, allowing an executable PHP file to pass validation. Limiting factors that reduce realistic risk: exploitation is impossible if the Helpdesk module is disabled, and it requires a valid low-privilege account - most impactful on sites permitting open user registration.

This is a genuinely high-priority flaw where multiple signals align rather than conflict. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and the 8.8 score are consistent with the description: a network-reachable REST endpoint, low attacker privilege (subscriber-level, authenticated), no user interaction, and full C:H/I:H/A:H impact because arbitrary file upload of a .php payload yields remote code execution (CWE-434). No EPSS score, no CISA KEV listing, and no public exploit (POC) were supplied in the input, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation - this tempers urgency somewhat relative to a KEV-listed bug. The main real-world risk reducers are two preconditions that CVSS does not fully capture: the attacker must already hold a valid authenticated account (subscriber or above), and the Helpdesk module must be enabled for the vulnerable REST endpoint to be registered at all. On sites allowing open registration with the Helpdesk module active, PR:L collapses to a near-trivial barrier, making this a realistic RCE path; on sites without self-registration or without the Helpdesk module, exploitation is substantially harder. Net: a real priority for affected deployments, but its blast radius is gated by product prevalence and the module/registration configuration rather than by the CVSS number alone.

An attacker registers (or obtains) a subscriber-level account on a WordPress site running the DoubleScale CRM plugin with the Helpdesk module enabled. They send a crafted request to the Helpdesk REST upload endpoint (store_upload) with a .php file whose magic bytes pass MIME detection; the fail-open extension_is_allowed() check returns true because wp_check_filetype() yields an empty type for the unrecognized .php extension, so the file is stored in a web-accessible location. The attacker then requests the uploaded PHP file directly to execute arbitrary code. No public exploit is identified at time of analysis, though the Wordfence advisory and source references pinpoint the exact vulnerable functions.