Unauthenticated file upload in Contact Manager WordPress plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The Contact Manager WordPress plugin up to and including 9.1.2 has an incomplete extension blacklist in its add_message function. A trailing dot hides dangerous extensions from the check, and sanitize_file_name() then removes the dot before the file is written (CWE-434). An unauthenticated remote attacker can upload files that may be executable, which enables remote code execution on Apache with libapache2-mod-php, which maps .phar to PHP, if the attacker retrieves the file before it is deleted.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version is listed for Contact Manager. All versions up to and including 9.1.2 are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-28 Threatist record created from CVE-2026-109218
- 2026-10-28 Alias added: GHSA-gfc3-vp5h-pp8w
- 2026-10-29 CISA SSVC decision points changed
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b359ef59-4c2e-4d4e-b000-1845525131de?source=cve
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L256
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L254
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/contact-manager.php#L42
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/forms/processing.php#L102
- https://fr.wordpress.org/plugins/contact-manager/
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3767815%40contact-manager%2Ftags%2F9.1.3&old=3661172%40contact-manager%2Ftags%2F9.1.2
More kleor vulnerabilities
- TI-2025-42312 WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability CVSS 3.1HIGH 8.8
- TI-2025-00869 Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload CVSS 3.1HIGH 8.1
- TI-2025-08724 Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode CVSS 3.1HIGH 7.2
- TI-2026-25045 WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2025-08034 Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title' CVSS 3.1MEDIUM 4.4
Sources
- CVE-2026-109218 · CVE Program
- CVE-2026-109218 · NVD
- FIRST EPSS
- GHSA-gfc3-vp5h-pp8w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences