Unrestricted File Upload Vulnerability in WP Mailster by WordPress
CVE-2026-111832

10CRITICAL

Key Information:

Vendor

WordPress
Status
WP Mailster
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111832?

The WP Mailster plugin for WordPress is susceptible to an unrestricted upload of files with dangerous types, which could allow attackers to upload web shells to the web server. This vulnerability affects versions up to 1.9.1.0, posing significant risks to affected installations. Implementing proper file validation and security measures is crucial to mitigate this risk and protect your web application from potential exploits.

Affected Version(s)

WP Mailster 0 <= 1.9.1.0

References

https://patchstack.com/database/wordpress/plugin/wp-mails...
vdb-entry

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Tang | Patchstack Bug Bounty Program
.