CVE-2026-109218criticalCWE-434

CVE-2026-109218: critical vulnerability in kleor Contact Manager

Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

Published · Updated

Follow this CVE+ Monitor Contact Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.6%
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
kleor · Contact Manager
Related CVEs — kleor Contact Manager

In the same product, most dangerous first.

CVE-2025-1028HIGHContact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension UploadEPSS 0.8%CVE-2025-8783MEDIUMContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'EPSS 0.3%