Critical 9.8Published Oct 28, 2026

CVE-2026-109218Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

Updated under an hour ago (Oct 30, 2026, 6:10 AM ET)

Does this affect you?

It affects kleor Contact Manager. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.64%, higher than 51% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for kleor Contact Manager Exploited in the last 30 days

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-434
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.64% (percentile 51)
Assigned by: Wordfence
NVD analysis: Deferred
Record last updated: Oct 28, 2026
First seen by InfoSec Signals: Oct 28, 2026

Affected products

Affected products

kleor Contact Manager kleor:contact_manager (from the name)	through 9.1.2	CNA record

References

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/b359ef59-4c2e-4d4e-b000-1845525131de?source=cve
https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L256
https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L254
https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/contact-manager.php#L42
https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/forms/processing.php#L102
https://fr.wordpress.org/plugins/contact-manager/
https://plugins.trac.wordpress.org/changeset?reponame=&new=3767815%40contact-manager%2Ftags%2F9.1.3&old=3661172%40contact-manager%2Ftags%2F9.1.2

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.