CVE-2026-111311

8.8High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-434

Impact

Authenticated users with subscriber access or higher can achieve remote code execution by uploading arbitrary executable files. Exploitation requires network access to the site with the plugin's Helpdesk module enabled.

Root cause

The store_upload function fails open when validating extensions, allowing unhandled types like PHP to pass while relying solely on magic-byte checks without capability verification.

Affected systems

DoubleScale plugin for WordPress up to and including version 1.5.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade DoubleScale to a version newer than 1.5.1 once available; as an immediate interim mitigation, disable the Helpdesk module or deactivate the plugin.

shell

$ wp plugin deactivate doublescale

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111311