WP Mailster EUVD-2026-104325

Exploitation requires an authenticated WordPress session (CVSS PR:L) on a site running WP Mailster version 1.9.1.0 or earlier; the attacker must reach a plugin feature that passes attacker-controlled input into a PHP include/require path. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N). Limiting factors: the requirement for valid credentials/a registered account significantly narrows the attacker population compared to an unauthenticated flaw, and impact is confined to local file disclosure (C:H, I:N, A:N) - there is no direct code-execution, data-modification, or denial-of-service capability per the stated vector. The exact privilege level and whether the vulnerable endpoint is reachable by low-tier roles (e.g., subscriber) should be confirmed against the Patchstack advisory.

This is a moderate-priority vulnerability that should be patched promptly but does not rise to emergency status. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates network-reachable, low-complexity exploitation that requires at least low-level authentication (PR:L) and yields high confidentiality impact with no integrity or availability impact - consistent with a Local File Inclusion / information-disclosure bug (CWE-98) rather than remote code execution. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no evidence of active exploitation or widespread automated attacks; exploitation status is therefore 'no public exploit identified at time of analysis.' The main signals are internally consistent: a network-facing but authenticated flaw in a WordPress plugin, which Patchstack (the reporting source) typically classifies as requiring a logged-in user (e.g., subscriber/author-level). The one point to verify is the exact privilege level WP Mailster requires, since PR:L only tells us authentication is needed, not the specific role. In short: a genuine but contained confidentiality issue - prioritize for routine patching, not incident response, absent new exploitation signals.

An authenticated WordPress user (per CVSS PR:L) sends a crafted request to a WP Mailster plugin endpoint that improperly handles a filename/path parameter used in a PHP include/require statement, causing the server to include a local file. The attacker reads sensitive server-side files such as wp-config.php (database credentials, auth salts) or other configuration/log files, enabling further compromise. No public exploit code was identified in the provided data, and no user interaction is required (UI:N).