Key points
- The flaw affects DoubleScale CRM plugin versions up to and including 1.5.1 for WordPress.
- Attackers need only subscriber-level access to exploit the arbitrary file upload issue.
- The vulnerability has a CVSS score of 8.8, classified as high severity by the NVD.
The DoubleScale | All-in-One CRM plugin for WordPress contains a significant security flaw in all versions up to 1.5.1. The National Vulnerability Database rates the issue as high severity with a score of 8.8. The defect allows authenticated users to upload files that could execute code on the server. This risk exists specifically when the plugin's Helpdesk module is enabled.
In plain English
The plugin permits file uploads through a function designed for the Helpdesk feature. The code fails to properly restrict file types when the system cannot identify an extension. It treats unrecognized extensions, such as .php, as allowed by default. Additionally, the system relies solely on magic-byte MIME detection without verifying user capabilities beyond basic login status. This combination lets users upload executable scripts.
The background
The vulnerability is tracked as CVE-2026-111311 and falls under the CWE-434 weakness category. The issue stems from the `extension_is_allowed()` function returning true when `wp_check_filetype()` yields an empty result. This occurs with extensions the system does not recognize. The lack of strict capability checks means anyone with a subscriber account can trigger the upload process if the Helpdesk module is active.
What changes now
No patch or fix has been confirmed yet for this vulnerability. Site administrators must assess their exposure based on plugin version and module configuration. If the Helpdesk module is not used, the risk is lower, but the plugin itself remains vulnerable in versions up to 1.5.1. Monitoring official channels for an update is essential until a secure version is released.
Who needs to act first
Teams usually prioritize systems that are directly accessible to the public or low-level users. Check whether the Helpdesk module is enabled on any sites running this plugin. If it is active, consider disabling that specific module temporarily to block the vulnerable endpoint. Back up site data before making any configuration changes. Roll out any future updates in a staging environment first to ensure stability before applying them to live production servers.
What to do and how to stay safe: WordPress
- Verify if the DoubleScale CRM plugin is installed and check its current version number.
- Disable the Helpdesk module immediately if the plugin version is 1.5.1 or older.
- Review user accounts to ensure no unauthorized subscribers have access to the site.
- Monitor vendor announcements for a security update that addresses CVE-2026-111311.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability allow remote code execution?
Yes, the flaw allows authenticated attackers to upload executable files, which makes remote code execution possible.
What level of access is needed to exploit this?
An attacker needs subscriber-level access or higher to perform the file upload.
Is there a fix available yet?
No fix has been confirmed yet for versions up to 1.5.1.
