WP Mailster, a WordPress plugin used to turn a mailbox into a mailing list, accepted uploaded files from anyone who could reach the site. No account, no login, no role check. An attacker could put a PHP file on the server and then call it in a browser, which is a web shell and the usual first step to taking the site over.
What happened
Patchstack published the flaw as CVE-2026-111832 on 19 October 2026, with a CVSS score of 10.0. The weakness class is unrestricted upload of a file with a dangerous type (CWE-434), and the vendor's own changelog for 1.9.2 on 18 October lists hardened attachment storage that stops executable uploads while keeping original filenames.
The same 1.9.2 release also closed a stored cross-site scripting issue in email headers and web previews, and restricted CSV import and export to administrators. So the patch is doing more than one job, which is worth knowing if you were planning to defer it.
Who is affected
Every site running WP Mailster at version 1.9.1.0 or older is exposed until it is updated. That includes sites where the plugin is installed but no shared mailbox is actively connected, because the upload path does not depend on a working mail connection.
- WordPress sites running WP Mailster 1.9.1.0 or earlier, including 1.9.0.0 and older branches.
- Agencies and hosts that manage client sites on a shared plugin stack and have not pinned or updated WP Mailster.
- Anyone who installed the plugin for a single mailing list and forgot it was there, which is a common pattern on small business sites.
What to do now
Update WP Mailster to 1.9.2.0 or later today, then inspect the uploads directory for PHP files that were not there before. The upload itself is unauthenticated, so a patch closes the door but does not tell you whether anyone already walked through it.
- Update to 1.9.2.0 from the WordPress admin or with WP-CLI, then confirm the version on the plugins screen rather than trusting the update banner.
- List files under wp-content/uploads for that plugin and look for .php, .phtml or .phar files. A mailing list plugin has no reason to store executable code.
- If you find one, treat the site as compromised: rotate database and hosting credentials, check for new administrator accounts, and review scheduled tasks.
- If you cannot patch immediately, deactivate or remove the plugin. A deactivated plugin cannot serve the upload path.
What this means for South African businesses
A CVSS 10.0 unauthenticated file upload on a plugin with a small installed base still gets scanned for, because scanners do not care how popular a target is. Small South African business sites tend to sit on shared hosting with one administrator and no file integrity monitoring, so a web shell can survive for months and then be used to host phishing pages or send mail under your domain.
My read is that the realistic exposure is not the plugin itself but the habit around it: plugins get installed for one campaign, never removed, and never appear on anyone's patch list. If you cannot name every plugin on a site, you cannot claim the site is patched.
The primary technical detail is in Patchstack's advisory for CVE-2026-111832, with the vendor changelog at patchstack.com.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.