Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Contact Manager up to 9.1.2 lets strangers upload files

CVE-2026-109218 · published today
Summary

The Contact Manager extension for WordPress (versions through 9.1.2) allows anyone on the internet to place a file on your server by using a specially crafted filename. If the server runs Apache with PHP handling, the uploaded file could be run as code, giving the attacker control. Update the plugin or remove it, and ensure your server blocks execution of uploaded files.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kleor contact manager <= 9.1.2
Original advisory text
Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Type
CWE-434Unrestricted File Upload
Timeline
Published28 Oct 2026
Updated28 Oct 2026
First seen28 Oct 2026
Sources
CVE-2026-109218 · NVD
CVE-2026-109218 · MITRE
Track software like this
Free during beta