Arbitrary file upload in Samuelgallegos Doublescale Crm | All-In-One – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, Mcp & More

CVE-2026-111311

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.

Vulnerability class: Unrestricted File Upload

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-111311?
CVE-2026-111311 is a high-severity vulnerability in Samuelgallegos Doublescale Crm | All-In-One – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, Mcp & More, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-10-16.
How severe is CVE-2026-111311?
High severity. CVSS v3 base score is 8.8 out of 10.