CVE-2026-111311: CWE-434 Unrestricted Upload of File with Dangerous Type in samuelgallegos DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More

CVE-2026-111311 is an arbitrary file upload vulnerability in the DoubleScale CRM WordPress plugin versions up to and including 1.5.1. The vulnerability arises from a fail-open extension allow-list in the extension_is_allowed() function, which returns true when wp_check_filetype() does not recognize the file extension (e.g., .php). Combined with MIME detection based only on magic bytes and a capability check limited to is_user_logged_in(), this allows authenticated users with subscriber-level privileges or higher to upload files that may be executable. The vulnerability is exploitable only if the Helpdesk module is enabled, as the vulnerable REST endpoint is registered only in that case. This can lead to remote code execution on the affected system.

An attacker with subscriber-level or higher access can upload arbitrary files, including executable ones, potentially leading to remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 score of 8.8 (high severity), indicating a significant risk if exploited.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and consider disabling the Helpdesk module if not required, as the vulnerability depends on this module being active.