DoubleScale CRM Plugin Permits Arbitrary File Uploads via Broken Validation

The DoubleScale CRM plugin for WordPress contains a high-severity arbitrary file upload vulnerability. This flaw affects all versions up to 1.5.1 and allows authenticated attackers to upload executable files, potentially leading to remote code execution.

What happened

The National Vulnerability Database records CVE-2026-111311 with a CVSS score of 8.8, rating it as high severity. The flaw resides in the store_upload function of the DoubleScale plugin, which is developed by samuelgallegos. The vulnerability is classified under CWE-434, indicating an unrestricted upload of a file with a dangerous type.

The root cause involves a failure in the extension_is_allowed() function. This function returns true when wp_check_filetype() yields an empty type for unrecognized extensions, such as .php. This fail-open behavior effectively bypasses the intended allow-list mechanism.

Additionally, the plugin relies solely on magic-byte MIME detection for file validation. It does not perform any capability checks beyond verifying that the user is logged in. This means even low-privilege accounts can trigger the vulnerable code path.

Exploitation requires the Helpdesk module to be enabled within the plugin settings. The vulnerable REST endpoint is only registered when this specific module is active. If the Helpdesk feature is disabled, the attack vector described in the advisory is not present.

Why it matters

Any user with subscriber-level access or higher can exploit this vulnerability. This includes standard WordPress subscribers, which are often created for customers or community members. The barrier to entry for an attacker is therefore quite low.

Successful exploitation allows the upload of files that may be executable. Once an executable file is uploaded, an attacker can achieve remote code execution on the server. This compromises the entire WordPress installation and potentially the underlying server infrastructure.

The combination of weak validation and minimal access controls makes this a significant risk. Organizations using DoubleScale CRM must assess their user base and module configurations. Environments with the Helpdesk module enabled are immediately exposed to this threat.

What to watch

• Verify if the DoubleScale CRM plugin is installed on any managed WordPress sites.
• Check the plugin version to determine if it is 1.5.1 or earlier.
• Determine if the Helpdesk module is currently enabled in the plugin settings.
• Review user accounts with subscriber-level access or higher for suspicious activity.

Signals worth monitoring

Security teams should monitor web server logs for unusual POST requests to REST endpoints associated with the DoubleScale plugin. Look for uploads of files with executable extensions or unexpected MIME types. Alert on successful file uploads from low-privilege user accounts, as this is atypical behavior. Check for subsequent HTTP requests to newly uploaded files, which may indicate an attacker testing for remote code execution. Investigate any sudden spikes in outbound traffic from the server, which could signal data exfiltration or command-and-control communication.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: DoubleScale CRM

• Audit all WordPress installations for the presence of the DoubleScale CRM plugin.
• Disable the Helpdesk module within the plugin settings if an immediate update is not available.
• Restrict file upload capabilities for subscriber-level users through server-side configurations.
• Monitor server file systems for new executable files in upload directories until a patch is confirmed.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the DoubleScale CRM plugin are vulnerable?

All versions up to and including 1.5.1 are vulnerable to this arbitrary file upload flaw.

What level of access does an attacker need to exploit this?

An attacker needs authenticated access with subscriber-level privileges or higher.

Is the vulnerability present in all configurations of the plugin?

No, exploitation requires the Helpdesk module to be enabled, as the endpoint is only active then.