CVE-2026-109218 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the Contact Manager plugin for WordPress, affecting all versions up to and including 9.1.2, that can let unauthenticated attackers achieve remote code execution under certain server conditions.
What Is It
The flaw is in the plugin's add_message function and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The plugin uses an extension blacklist that misses dangerous extensions when a filename ends in a trailing dot. In that case, the extension-derivation routine returns an empty string. WordPress's sanitize_file_name() then silently strips the trailing dot before the file is written to disk, so a file with a dangerous extension gets past the blacklist check.
Wordfence reported the issue. The NVD record was published on October 28, 2026 and currently has a status of "Deferred."
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- It can be exploited over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- Confidentiality, integrity and availability impact are all high.
Unauthenticated attackers can upload files that may be executable, which makes remote code execution possible. According to the description, code execution also needs two conditions:
- The server runs Apache with libapache2-mod-php, which maps .phar to PHP by default.
- The attacker requests the uploaded file in the short window before unlink() deletes it at the end of the request.
These conditions narrow the practical attack surface, but exploitation doesn't require any authentication.
The supplied CISA KEV data contains no entry for this CVE, so active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: kleor
- Product: Contact Manager (WordPress plugin)
- Affected versions: all versions up to and including 9.1.2
The source data lists no CPEs. Sites face the most risk if they run an affected version on Apache with libapache2-mod-php.
Patch Status
The NVD references include a WordPress plugin changeset comparing the 9.1.2 tag with a 9.1.3 tag. This suggests a fix is in version 9.1.3, but the supplied data does not explicitly confirm that 9.1.3 fixes the issue. Administrators should update past 9.1.2 and check the Wordfence advisory for remediation guidance. The KEV data contains no required action or due date.