CVE-2026-27064 EverPress CVE debrief

Who should care

Defenders responsible for WordPress installations with the Mailster plugin, version 4.1.17 or earlier, should assess exposure and prioritize remediation or compensating controls.

Why it matters

CVE-2026-27064 is a critical vulnerability in the Mailster plugin for WordPress, allowing for arbitrary file uploads with a CVSS score of 9.1. Defenders should prioritize verifying exposure, assessing potential impacts, and applying remediation or compensating controls.

• Verification of Mailster plugin version and exposure is necessary to prevent potential arbitrary file uploads.
• Assessment of confidentiality, integrity, and availability impacts is required to determine the extent of potential damage.
• Application of vendor remediation or compensating controls is crucial to mitigate the vulnerability.
• Monitoring for suspicious activity related to file uploads can help detect potential exploitation attempts.

Technical summary

The Mailster plugin for WordPress, version 4.1.17 and possibly earlier, contains a critical vulnerability allowing for arbitrary file uploads. This issue, tracked as CVE-2026-27064, has been assessed with a CVSS score of 9.1, indicating a high severity level. The vulnerability is exploitable over the network with low attack complexity, requiring high privileges but no user interaction. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability.

Defensive priority

Defenders should prioritize verifying exposure of Mailster plugin versions 4.1.17 and earlier, assessing potential impacts on confidentiality, integrity, and availability, and applying vendor remediation or compensating controls as available.

Recommended defensive actions

• Verify Mailster plugin version and assess exposure
• Evaluate potential impacts on confidentiality, integrity, and availability
• Apply vendor remediation or compensating controls as available
• Monitor for suspicious activity related to file uploads

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, specific details on exploitation, victims, or business impact are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.