Software component issue could allow unintended commands to run

What happened

• The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.Security Advisory CVE-2026-111311
• The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function.Advisory description (CVE-2026-111311)

Contributing factors stated by the source

• The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function.

The failure pattern

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

• ASI01 Agent Goal Hijack
• ASI02 Tool Misuse and Exploitation
• ASI03 Identity and Privilege Abuse
• ASI06 Memory and Context Poisoning
• ASI10 Rogue Agents
• LLM01 Prompt Injection
• LLM02 Sensitive Information Disclosure
• LLM03 Excessive Agency
• LLM10 Improper Output Handling
• AC-3 Access Enforcement
• AC-4 Information Flow Enforcement
• AC-5 Separation of Duties
• AC-6 Least Privilege
• SI-10 Information Input Validation
• RV.3.4 Update the development process
• MAP 5.1 Estimate impacts from past uses and public incident reports
• Goal 3 Reducing entire classes of vulnerability
• CWE-862 Missing Authorization
• CWE-1427 Improper Neutralization of Input Used for LLM Prompting
• CWE-250 Execution with Unnecessary Privileges

Incidents with the same pattern