The DoubleScale | All-in-One CRM plugin for WordPress contains an arbitrary file upload flaw caused by a fail‑open extension allow‑list in the store_upload function, which accepts files with unknown extensions such as .php when wp_check_filetype() does not return a recognized MIME type. Because the REST endpoint performs only a simple is_user_logged_in() check, an authenticated user with subscriber or higher privileges can upload and execute files, resulting in remote code execution.

This flaw affects all versions of the plugin up to and including 1.5.1. The vulnerable REST endpoint is registered only when the Helpdesk module is active, so any WordPress site that has the DoubleScale plugin installed with the Helpdesk module enabled is susceptible. The plugin provides a range of sales, marketing, newsletter, booking, helpdesk, automation, and other features, but the critical issue lies in its attachment handling logic.

The CVSS score is 8.8, indicating a high severity and a substantial risk to confidentiality, integrity, and availability. The EPSS score is very low (< 1%), and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers require only authenticated access at the subscriber level or above and the Helpdesk module to be active to exploit the flaw. Once exploited, the attacker can upload and execute arbitrary code, giving full control over the affected WordPress installation.