{"id":"CVE-2026-109218","published":"2026-10-28T07:16:44.120","lastModified":"2026-10-28T07:16:44.120","description":"The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://fr.wordpress.org/plugins/contact-manager/","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/contact-manager.php#L42","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L254","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L256","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/forms/processing.php#L102","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3767815%40contact-manager%2Ftags%2F9.1.3&old=3661172%40contact-manager%2Ftags%2F9.1.2","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b359ef59-4c2e-4d4e-b000-1845525131de?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Contact Manager WordPress plugin (up to v9.1.2) allows unauthenticated arbitrary file uploads due to a flawed extension blacklist: when a filename ends with a dot, sanitize_file_name() strips the trailing dot, causing the extension check to return an empty string and bypass the blacklist, enabling upload of executable files like .phar.","exploitability":"Exploitation is difficult in practice because it requires specific server conditions (Apache with libapache2-mod-php mapping .phar to PHP) and precise timing to access the uploaded file before it is deleted at request end.","blast_radius":"If exploited, attackers could achieve remote code execution on the web server, leading to full system compromise, data theft, or lateral movement within the network.","remediation":"Upgrade to Contact Manager version 9.1.3 or later, which fixes the incomplete extension blacklist and the trailing-dot bypass.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","file-upload","wordpress","bypass","phar"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:02:23.611Z"}}