{"id":"CVE-2026-111832","published":"2026-10-21T15:17:15.130","lastModified":"2026-10-21T18:19:16.950","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-mailster/vulnerability/wordpress-wp-mailster-plugin-1-9-1-0-arbitrary-file-upload-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP Mailster plugin allows unauthenticated users to upload files of any type, including dangerous web-shells, due to missing file-type restrictions.","exploitability":"Exploitation is straightforward for an attacker with network access and requires no authentication or user interaction.","blast_radius":"Successful exploitation could lead to full server compromise via remote code execution, enabling data theft, site defacement, or lateral movement.","remediation":"Upgrade to WP Mailster version 1.9.1.1 or later, which patches the unrestricted upload vulnerability.","detection":"Look for HTTP POST requests to the plugin's upload endpoint (e.g., /wp-admin/admin-ajax.php?action=mailster_upload) containing a file with a web-shell extension (e.g., .php, .phtml) and an unusually large or suspicious filename pattern in access logs.","tags":["unrestricted-upload","web-shell","rce","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:42:37.301Z"}}