{
 "id": "WPSEC-2026-1270",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1270/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1270/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1270/index.md",
 "title": "WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Arbitrary File Read via CSV Import",
 "description": "The WP Mailster plugin for WordPress is vulnerable to Arbitrary File Read via the CSV user import feature ('filepath' parameter with the 'server_file' data source) in all versions up to, and including, 1.9.1.0. This is due to two things. The import and export subpages are served from the plugin's top-level menu, which is registered with the 'edit_posts' capability, and they perform no further capability check. The server file path is also appended to the WordPress home path without any validation or containment. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, such as wp-config.php, because the lines that fail parsing are echoed back on the page. They can also export mailing list user data and import users.",
 "plugin": {
  "slug": "wp-mailster",
  "name": "WP Mailster",
  "full_name": "WP Mailster",
  "wordpress_org": "https://wordpress.org/plugins/wp-mailster/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-mailster/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-mailster"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.2.0",
 "remediation": "Update to 1.9.2.0 or later.",
 "fix_released": "2026-10-18T16:05:12+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:13:00.455277+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1270/",
  "https://plugins.svn.wordpress.org/wp-mailster/tags/1.9.2.0/",
  "https://wordpress.org/plugins/wp-mailster/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-mailster",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-20"
 }
}