CVE-2026-111829: WP Mailster Path Traversal Vulnerability

CVE-2026-111829 Overview

CVE-2026-111829 is a Local File Inclusion (LFI) vulnerability in the WP Mailster WordPress plugin. The flaw affects all versions of WP Mailster up to and including 1.9.1.0. It stems from improper control of filename parameters used in PHP include or require statements, categorized under [CWE-98]. An authenticated attacker with low privileges can exploit the vulnerability over the network to read sensitive files on the server hosting the WordPress installation. Successful exploitation compromises confidentiality but does not directly impact integrity or availability.

Critical Impact
Authenticated attackers can include arbitrary local files via PHP include/require statements, exposing sensitive server-side data such as configuration files, credentials, and secrets.

Affected Products

WP Mailster plugin for WordPress, versions up to and including 1.9.1.0

Discovery Timeline

2026-10-19 - CVE CVE-2026-111829 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111829

Vulnerability Analysis

The WP Mailster plugin fails to properly validate user-supplied input passed to PHP file inclusion functions. Attackers abuse this flaw to traverse the filesystem and load arbitrary PHP files from the host. Because the inclusion path is derived from attacker-controlled input, the plugin executes or exposes the contents of local files during request handling.

The EPSS score for this vulnerability is 0.321% with a percentile of 23.906, indicating a currently low observed exploitation probability. However, LFI vulnerabilities in widely deployed WordPress plugins frequently become targets for automated scanners once public details circulate.

An authenticated session with low-level privileges is required, which limits anonymous mass exploitation but does not prevent abuse by low-trust accounts such as subscribers or compromised contributor-level users.

Root Cause

The underlying weakness is [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin accepts a filename or path parameter from HTTP input and passes it to a PHP include, include_once, require, or require_once call without sufficient sanitization or allow-list validation. Path traversal sequences and absolute paths are not stripped or rejected.

Attack Vector

The attack vector is network-based and requires an authenticated low-privileged WordPress account. An attacker submits a crafted HTTP request to a vulnerable WP Mailster endpoint, supplying a manipulated filename parameter. The server resolves and includes the requested file, returning its contents in the response or executing it as PHP. Common targets include wp-config.php, log files containing injected PHP payloads, and credential stores readable by the web server user.

No public proof-of-concept exploit is currently referenced in the advisory. Technical details are available in the Patchstack WP Mailster Vulnerability advisory.

Detection Methods for CVE-2026-111829

Indicators of Compromise

HTTP requests to WP Mailster endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes in query or POST parameters.
Access log entries referencing sensitive filesystem paths like wp-config.php, /etc/passwd, or PHP session files via WP Mailster URLs.
Unexpected PHP error log entries referencing include() or require() failures tied to plugin files.

Detection Strategies

Inspect web server and WordPress access logs for authenticated requests to WP Mailster handlers containing filename or path parameters with directory traversal patterns.
Deploy web application firewall rules that identify LFI patterns, including encoded traversal and absolute path references, directed at /wp-admin/admin.php or AJAX endpoints invoking WP Mailster.
Correlate low-privileged user activity with file read anomalies on the WordPress host, such as unexpected reads of configuration or environment files by the PHP-FPM or Apache process.

Monitoring Recommendations

Enable WordPress audit logging to track plugin actions performed by subscriber, contributor, and author accounts.
Monitor filesystem access patterns on the WordPress host to flag reads of sensitive files initiated by the web server user outside expected plugin behavior.
Alert on bursts of 4xx or 5xx responses from WP Mailster endpoints that often accompany LFI payload fuzzing.

How to Mitigate CVE-2026-111829

Immediate Actions Required

Update the WP Mailster plugin to a version later than 1.9.1.0 as soon as a patched release is available from the vendor.
Audit existing WordPress user accounts and remove or demote unnecessary low-privileged accounts that could satisfy the authentication requirement.
Review web server logs for prior exploitation attempts targeting WP Mailster endpoints with suspicious filename parameters.

Patch Information

Refer to the Patchstack WP Mailster Vulnerability advisory for the latest patch status. If a fixed version has not been released, consider deactivating and removing the plugin until a vendor patch is published.

Workarounds

Deactivate the WP Mailster plugin until a fixed version is installed.
Deploy a WordPress-aware web application firewall with virtual patching rules that block LFI payloads targeting WP Mailster endpoints.
Restrict PHP open_basedir to the WordPress document root to constrain the impact of file inclusion attempts.
Enforce least privilege on the PHP-FPM or web server user so that sensitive files outside the WordPress tree are not readable.

bash

# Example php.ini hardening to limit file inclusion impact
open_basedir = "/var/www/wordpress:/tmp"
allow_url_include = Off
allow_url_fopen = Off