CVE-2026-27064
This vulnerability allows an attacker to upload any file through the Mailster editor in versions 4.1.17 and earlier. The flaw could let attackers place malicious files on the server, potentially leading to code execution or data theft. It is considered critical due to the high impact on confidentiality, integrity, and availability.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Mailster plugin versions 4.1.17 and earlier, typically used by WordPress site owners.
Real-world impact
An attacker could upload malicious scripts or files that the server might execute, giving the attacker full control over the website and its data.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely with low effort, requires the attacker to have high privileges (e.g., a logged‑in editor), and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- ›Avoid uploading files via the editor until a patch is released.
- ›If possible, disable the editor’s file upload feature to prevent exploitation.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources