CVE-2026-111311: DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension allow-list in extensionisallowed() that returns true when wpcheckfiletype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond isuserloggedin(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running DoubleScale All-in-One CRM version 1.5.1 or earlier are exposed only when the Helpdesk module is enabled. The vulnerable REST endpoint is registered only while that module is active.
What access does an attacker need?
An attacker must be authenticated as a WordPress user. Subscriber-level access is sufficient; no additional capability check is performed beyond confirming that the user is logged in.
What is the likely impact of successful exploitation?
An authenticated attacker can upload files that may be executable because unrecognized extensions, including .php, can pass the fail-open extension check. This can lead to remote code execution with high confidentiality, integrity, and availability impact.
What mitigation is available if updating cannot happen immediately?
Disable the DoubleScale Helpdesk module to prevent registration of the vulnerable REST endpoint. Restricting or removing low-privilege authenticated accounts also reduces exposure, since subscriber access is sufficient for exploitation.