# WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Arbitrary File Read via CSV Import

- **ID:** WPSEC-2026-1270
- **Plugin:** WP Mailster (`wp-mailster`), https://wordpress.org/plugins/wp-mailster/
- **Affected versions:** all versions before 1.9.2.0
- **Fixed in:** 1.9.2.0 (Update to 1.9.2.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-mailster
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1270/

## Description

The WP Mailster plugin for WordPress is vulnerable to Arbitrary File Read via the CSV user import feature ('filepath' parameter with the 'server_file' data source) in all versions up to, and including, 1.9.1.0. This is due to two things. The import and export subpages are served from the plugin's top-level menu, which is registered with the 'edit_posts' capability, and they perform no further capability check. The server file path is also appended to the WordPress home path without any validation or containment. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, such as wp-config.php, because the lines that fail parsing are echoed back on the page. They can also export mailing list user data and import users.

## References

- https://wpsec.com/vuln/WPSEC-2026-1270/
- https://plugins.svn.wordpress.org/wp-mailster/tags/1.9.2.0/
- https://wordpress.org/plugins/wp-mailster/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1270/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.