Cpe:2.3:a:wordpress:contact_manager:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awordpresscontact_manager/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:26:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWordPress Contact Manager: Arbitrary File Upload (CVE-2026-109218)https://feed.craftedsignal.io/briefs/2026-10-contact-manager-wordpress-rce/Wed, 28 Oct 2026 08:26:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-contact-manager-wordpress-rce/The Contact Manager plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2026-109218) in the add_message function, potentially allowing remote code execution for unauthenticated attackers.<p>The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 9.1.2 via the add_message function. The vulnerability arises from an incomplete extension blacklist; a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes. This may allow unauthenticated attackers to upload executable files. Remote code execution is possible if the server uses Apache with libapache2-mod-php and the attacker accesses the file before it is removed by unlink() at the end of the request.</p> criticaladvisory