CVE-2026-111832: WP Mailster Plugin — Critical Unrestricted File Upload Leads to Web Shell

Executive Summary

A maximum-severity unrestricted file upload vulnerability has been published for the WP Mailster plugin (wp-mailster) for WordPress. Tracked as CVE-2026-111832 with a CVSS score of 10.0, the flaw is classed as Unrestricted Upload of File with Dangerous Type and allows an attacker to upload a web shell to the web server.

The advisory was published to the NVD on 2026-10-21 and lists affected versions as from n/a through 1.9.1.0.

Vulnerability Overview

Root Cause

The plugin does not adequately restrict the types of files that can be uploaded. An attacker can therefore place an executable server-side script (a web shell) on the site, which can then be requested directly to run arbitrary commands as the web server user.

Impact

Successful exploitation of a web shell upload typically results in:

• Remote code execution in the context of the web server account
• Full WordPress site takeover, including database credentials in wp-config.php
• Persistence through additional backdoors, rogue admin accounts, or scheduled tasks
• Lateral movement to other sites or services sharing the same host

The plugin handles mailing-list and email functionality, so compromised sites may also be abused for spam or phishing delivery.

Remediation

1. Update WP Mailster to a version later than 1.9.1.0 as soon as the vendor releases a fix. Check the plugin repository for current patch status.
2. If no patch is available, deactivate and remove the plugin.
3. Hunt for compromise: look for unexpected .php files in upload and plugin directories and recently modified files.
4. Review access logs for POST requests to the plugin's endpoints followed by requests to newly created files.
5. Rotate credentials (WordPress admin accounts, database password, salts) if any suspicious file is found.

Hardening

• Block PHP execution in wp-content/uploads/ at the web server level
• Deploy a WAF with file-upload inspection rules
• Run file-integrity monitoring on the WordPress directory tree

Key Takeaways

1. CVSS 10.0 — the highest possible severity score
2. All versions through 1.9.1.0 of WP Mailster are listed as affected
3. Web shell upload means code execution on the server, not just data exposure
4. WordPress plugin file-upload bugs are routinely mass-scanned once published, so treat exposure as urgent

References

• NVD — CVE-2026-111832
• OWASP — Unrestricted File Upload