WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Arbitrary File Read via CSV Import
- ID
- WPSEC-2026-1270
- Plugin
- WP Mailster (wp-mailster)
- Affected
- all versions before 1.9.2.0
- Remediation
- Update to 1.9.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-20
- Attack surface
- WP Mailster on WPSec AttackSurface
- Fix released
- Published
Description
The WP Mailster plugin for WordPress is vulnerable to Arbitrary File Read via the CSV user import feature ('filepath' parameter with the 'server_file' data source) in all versions up to, and including, 1.9.1.0. This is due to two things. The import and export subpages are served from the plugin's top-level menu, which is registered with the 'edit_posts' capability, and they perform no further capability check. The server file path is also appended to the WordPress home path without any validation or containment. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, such as wp-config.php, because the lines that fail parsing are echoed back on the page. They can also export mailing list user data and import users.
References
- https://wpsec.com/vuln/WPSEC-2026-1270/
- https://plugins.svn.wordpress.org/wp-mailster/tags/1.9.2.0/
- https://wordpress.org/plugins/wp-mailster/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS