Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass (kleor Contact Manager)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.64 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Wordfence
- NVD status
- Deferred
Description
The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.
Weaknesses (CWE)
- CWE-434 — Unrestricted Upload of File with Dangerous Type
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b359ef59-4c2e-4d4e-b000-1845525131de?source=cve
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L256
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/add-message.php#L254
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/contact-manager.php#L42
- https://plugins.trac.wordpress.org/browser/contact-manager/tags/9.1.2/includes/forms/processing.php#L102
- https://fr.wordpress.org/plugins/contact-manager/
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3767815%40contact-manager%2Ftags%2F9.1.3&old=3661172%40contact-manager%2Ftags%2F9.1.2
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Wordfence |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · security@wordfence.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-111608
- GCVE · GCVE-0-2026-109218
Affected products
| Product | Versions |
|---|---|
| kleor · Contact Manager | affected 0 ≤ 9.1.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |