DoubleScale CRM: Authenticated arbitrary file upload in Helpdesk portal
Summary
The DoubleScale All-in-One CRM plugin for WordPress allows authenticated users to upload arbitrary files via the Portal 'ticketless' attachment REST endpoint in versions up to and including 1.5.1. The file extension check fails open for unrecognized extensions such as .php, so an attacker with a subscriber-level account could upload executable files, which may lead to remote code execution on the web server. Exploitation requires the Helpdesk module to be enabled.
Affected
- DoubleScale | All-in-One CRM WordPress plugin, versions up to and including 1.5.1
- Exploitation requires the Helpdesk module to be enabled
- Any authenticated account with subscriber-level access or higher
Fixed in
Unknown. Sources disagree: one indicates 1.5.2, a third-party statement mentions 1.6.x. Verify the current version on wordpress.org/plugins/doublescale.
Workaround
- Disable the Helpdesk module if it is not needed (confirm in a test environment first)
- Restrict or disable open user registration
- No vendor-confirmed workaround found
Exploitation
- No confirmed in-the-wild exploitation found
- No public proof of concept found
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- EPSS score reported by a third-party tracker: 0.52%
Our recommendation
- Identify all WordPress sites running the DoubleScale plugin and record the installed version
- Check whether the Helpdesk module is enabled and disable it if it is not required
- Restrict user registration and review subscriber accounts
- Update to a fixed version as soon as it is confirmed on wordpress.org
- Review upload directories for unexpected executable files and monitor the Wordfence feed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence www.wordfence.com
- Trac: AttachmentService.php (tag 1.4.6) plugins.trac.wordpress.org
- Trac: RestPortalController.php (tag 1.4.6) plugins.trac.wordpress.org
- PT-2026-115536 (Positive Technologies) vulners.com
- VulDB entry vuldb.com
- NVD record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:05.
Original description (NVD)
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.
NVD references (5)
- https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Core/Services/AttachmentService.ph…
- https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Core/Services/AttachmentService.ph…
- https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Modules/Support/Rest/Controllers/R…
- https://plugins.trac.wordpress.org/browser/doublescale/tags/1.4.6/includes/Modules/Support/Rest/Controllers/R…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0feed03e-fedf-4443-94e0-fbb2c8baba71?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.