CVE-2026-109218
Received Received - Intake

Arbitrary File Upload in Contact Manager WordPress Plugin

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-109218
EUVD
EUVD-2026-111608

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kleor Contact Manager 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Contact Manager WordPress plugin allows unauthenticated attackers to upload arbitrary files to a server by exploiting an incomplete file extension blacklist. When a file with a dangerous extension (like .phar) is uploaded with a trailing dot, the system fails to detect the extension, allowing the file to be written to disk. If the server uses Apache with libapache2-mod-php, the .phar file can be executed as PHP code, enabling remote code execution. The uploaded file is automatically deleted after the request, but attackers can retrieve it within the brief window before deletion.

This vulnerability affects all versions of the plugin up to and including 9.1.2.

Detection Guidance

Check for uploaded files with suspicious extensions like .phar, .php, or .phtml in the WordPress uploads directory. Use commands like 'find /path/to/wordpress/wp-content/uploads -type f -name "*.phar"' or 'grep -r "add_message" /path/to/wordpress/wp-content/plugins/contact-manager/' to search for traces of exploitation.

Impact Analysis

If you use the vulnerable Contact Manager plugin, attackers could exploit this flaw to execute malicious code on your server. This could lead to complete control over your website, data theft, or further attacks against visitors. The vulnerability requires no authentication, making it easier for attackers to exploit.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering legal penalties, fines, and reputational damage under these regulations.

Mitigation Strategies

Immediately update the Contact Manager plugin to the latest version beyond 9.1.2. If an update is unavailable, disable or uninstall the plugin until a patch is released. Review server logs for signs of unauthorized file uploads and remove any suspicious files detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart