Arbitrary File Upload Vulnerability in Contact Manager Plugin for WordPress

CVE-2026-109218

What is CVE-2026-109218?

The Contact Manager plugin for WordPress contains an Arbitrary File Upload vulnerability that affects all versions up to and including 9.1.2. This flaw arises from an incomplete extension blacklist in the add_message function, allowing unauthenticated attackers to upload potentially dangerous files. The extension-derivation process can fail when a trailing dot is involved, leading to unsafe files being written to the server. Furthermore, if the server operates with Apache and libapache2-mod-php enabled, it increases the risk of remote code execution, as attackers can execute these files within a limited timeframe before they are deleted.

References