Arbitrary File Upload Vulnerability in Contact Manager Plugin for WordPress

CVE-2025-1028

What is CVE-2025-1028?

The Contact Manager plugin for WordPress has a critical issue allowing unauthorized file uploads due to inadequate file type validation in its upload feature. This vulnerability impacts all versions up to and including 8.6.4, enabling potential attackers to upload arbitrary files into the server, which may lead to remote code execution if the server processes the first file extension over the final one. Successfully exploiting this vulnerability also requires a race condition, further complicating the attack. Users of the affected versions should consider applying available updates to mitigate risks associated with this security issue.

References