Arbitrary File Upload Vulnerability in DoubleScale CRM by WordPress
CVE-2026-111311
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 October 2026
What is CVE-2026-111311?
The DoubleScale CRM plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability in versions up to 1.5.1. This weakness arises from a fail-open extension allow-list in the extension_is_allowed() function, where it naively returns true if wp_check_filetype() encounters an empty type for unrecognized extensions, such as .php. Coupled with magic-byte-only MIME detection and insufficient capability checks (limited to is_user_logged_in()), this flaw allows authenticated users with subscriber-level permissions and above to upload potentially executable files. Exploitation necessitates the activation of the Helpdesk module, as the vulnerable REST endpoint is only registered when this module is enabled. This poses significant risks of remote code execution if exploited by attackers.
Affected Version(s)
DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More 0 <= 1.5.1