CVE-2026-109218— Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

Quick assessment

Affected

kleor Contact Manager

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Contact Manager 插件在所有 9.1.2 及以下版本中，通过函数存在任意文件上传漏洞。该漏洞源于扩展名黑名单不完整：当文件名末尾包含一个点（trailing dot）时，扩展名推导逻辑会返回空字符串，随后会静默移除该空字符串，导致文件在写入磁盘前未能被有效拦截。这使得未认证的攻击者能够上传可能具有可执行权限的文件，进而实现远程代码执行（RCE）。成功执行代码还需满足以下条件：服务器需运行 Apache 并启用模块（该模块默认将文件映射为 PHP 脚本执行），且攻击者必须

CVSS 9.8 · Critical Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
kleor	Contact Manager	0 ~ 9.1.2	-

II. Public POCs for CVE-2026-109218

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109218

请登录查看更多情报信息。

Other References for CVE-2026-109218 (7)

https://www.cve.org/CVERecord?id=CVE-2026-109218

IV. Related Vulnerabilities

Same product: Contact Manager

Same vendor: kleor

Same weakness: CWE-434