CVE-2026-109218

Summary

The Contact Manager WordPress plugin (up to v9.1.2) allows unauthenticated arbitrary file uploads due to a flawed extension blacklist: when a filename ends with a dot, sanitize_file_name() strips the trailing dot, causing the extension check to return an empty string and bypass the blacklist, enabling upload of executable files like .phar.

Exploitability

Exploitation is difficult in practice because it requires specific server conditions (Apache with libapache2-mod-php mapping .phar to PHP) and precise timing to access the uploaded file before it is deleted at request end.

Blast radius

If exploited, attackers could achieve remote code execution on the web server, leading to full system compromise, data theft, or lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Contact Manager version 9.1.3 or later, which fixes the incomplete extension blacklist and the trailing-dot bypass.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.