CVE-2026-111829
MediumCVSS 6.5Summary
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.
Risk Assessment
An attacker could exploit the vulnerability to include local PHP files, potentially leading to code execution or information disclosure. The risk affects WordPress sites with the vulnerable plugin version installed.
Recommendation
Update the WP Mailster plugin to the latest version if available, or consider removing it if not in use. Regularly review WordPress plugins and remove unused ones.
Other vulnerabilities in WP Mailster
See all- CVE-2026-105061High
Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Mailster up to version 1.9.0.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
- CVE-2026-105055Medium
Missing authorization in WP Mailster plugin up to version 1.9.0.0. Allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS