CVE-2026-111832: WP Mailster RCE Vulnerability

CVE-2026-111832 Overview

CVE-2026-111832 is an unrestricted file upload vulnerability in the WP Mailster WordPress plugin. The flaw affects all versions of wp-mailster from an unspecified initial release through version 1.9.1.0. Attackers can upload files with dangerous types, including web shells, to the web server without authentication. Successful exploitation grants adversaries arbitrary code execution within the WordPress hosting environment. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated attackers can upload web shells to vulnerable WordPress sites, leading to full server compromise, data theft, and lateral movement into connected infrastructure.

Affected Products

• WP Mailster plugin for WordPress
• All versions through 1.9.1.0
• WordPress sites with the plugin installed and enabled

Discovery Timeline

• 2026-10-21 - CVE-2026-111832 published to NVD
• 2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111832

Vulnerability Analysis

The WP Mailster plugin exposes a file upload handler that fails to validate file types before writing uploaded content to the web root. Attackers submit a crafted multipart request containing a PHP payload disguised as a legitimate attachment or asset. The server stores the file in a web-accessible directory without extension filtering, MIME verification, or authentication checks. The attacker then invokes the uploaded PHP file via HTTP, triggering server-side code execution under the web server user context.

The scope change in the attack chain reflects that code execution within the WordPress process can pivot to the underlying host, databases, and adjacent cloud resources. No user interaction or credentials are required to reach the vulnerable endpoint.

Root Cause

The root cause is missing or inadequate input validation in the file upload routine [CWE-434]. The plugin does not enforce an allowlist of safe file extensions, does not verify the uploaded content against expected MIME types, and does not restrict upload capability to authenticated administrators. The combination of these failures permits arbitrary file placement anywhere the PHP interpreter will execute.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends an HTTP POST request to the vulnerable upload endpoint with a PHP web shell. Once stored, the attacker issues a GET request to the uploaded file path to invoke the shell. See the Patchstack advisory for additional technical context. No public proof-of-concept has been published at the time of this writing.

Detection Methods for CVE-2026-111832

Indicators of Compromise

• Unexpected .php, .phtml, or .phar files in WordPress upload directories such as wp-content/uploads/ or plugin-specific storage paths
• POST requests to WP Mailster endpoints followed shortly by GET requests to newly created files
• Outbound connections from the web server to unfamiliar IP addresses after suspicious uploads
• New administrator accounts or modified WordPress user tables following upload activity

Detection Strategies

• Monitor web server access logs for POST requests to wp-mailster handler scripts from unauthenticated sessions
• Hash and inventory files under wp-content/ and alert on new executable script files
• Deploy file integrity monitoring on the WordPress document root with real-time alerting
• Inspect WAF logs for multipart uploads containing PHP tags or known web shell signatures

Monitoring Recommendations

• Enable verbose PHP execution logging to identify scripts launched from upload directories
• Correlate HTTP upload events with subsequent process spawning on the web server
• Alert on php or sh processes spawning from the web server user with unusual parent paths
• Track outbound DNS and HTTP traffic from WordPress hosts for command-and-control patterns

How to Mitigate CVE-2026-111832

Immediate Actions Required

• Disable or remove the WP Mailster plugin on all WordPress instances until a patched version is confirmed installed
• Audit WordPress upload directories for unexpected PHP or executable files and remove any identified web shells
• Rotate all WordPress administrator credentials, API keys, and database passwords on affected sites
• Review web server, FTP, and WordPress logs for signs of post-exploitation activity across the exposure window

Patch Information

At the time of publication, the advisory lists versions through 1.9.1.0 as vulnerable. Review the Patchstack WP Mailster advisory for the current patched release and upgrade immediately once available.

Workarounds

• Block access to WP Mailster upload endpoints at the web application firewall until patching is complete
• Configure the web server to deny PHP execution within wp-content/uploads/ using directory-level rules
• Enforce authentication in front of the WordPress admin and plugin handler paths via reverse proxy controls
• Restrict file upload MIME types and extensions at the WAF layer to block .php, .phtml, .phar, and similar executable formats

# Example Apache configuration to block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php7|php8)$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>