WordPress Contact Manager: Arbitrary File Upload (CVE-2026-109218)
The Contact Manager plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2026-109218) in the add_message function, potentially allowing remote code execution for unauthenticated attackers.
CVE search metadata
CVE search record: CVE-2026-109218. Severity: critical. CVSS: 9.8. KEV: no. Product: Contact Manager (<= 9.1.2). Brief: WordPress Contact Manager: Arbitrary File Upload (CVE-2026-109218). Brief link: https://feed.craftedsignal.io/briefs/2026-10-contact-manager-wordpress-rce/
Triage facts
Revision 1- Applicability
- Contact Manager (<= 9.1.2)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 08:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 9.1.2 via the add_message function. The vulnerability arises from an incomplete extension blacklist; a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes. This may allow unauthenticated attackers to upload executable files. Remote code execution is possible if the server uses Apache with libapache2-mod-php and the attacker accesses the file before it is removed by unlink() at the end of the request.