External risk intelligence

WordPress Contact Manager Arbitrary File Upload Leading to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-109218

This vulnerability affects a WordPress plugin, which is specifically designed to function as a public-facing web component. Because the vulnerable function is accessible to unauthenticated users via the website's frontend, it is directly reachable and exposed to the internet by design in any standard WordPress deployment.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Contact Manager plugin for WordPress, allowing unauthenticated attackers to upload and potentially execute arbitrary files. This could enable remote code execution under specific server configurations. The primary concern is confirming if this plugin is in use and assessing potential exposure.

Unauthenticated file upload to WordPress plugin.
Enables remote code execution with specific server setups.
Confirm plugin use and assess exposure.

Attack Path

How an attacker could exploit the issue

Attackers can upload malicious files to a WordPress site by exploiting a flaw in the Contact Manager plugin. This flaw allows unauthenticated users to bypass security checks, leading to the upload of executable files. If the server is configured to process these files as PHP, and the attacker can access the file before it's deleted, it can result in remote code execution.

Unauthenticated access to the plugin.
Uploading files with a specially crafted extension.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory's conditions, unauthenticated attackers could upload executable files to a WordPress site. This could lead to remote code execution, particularly on servers using Apache with libapache2-mod-php, before the file is automatically removed.

Website files could be affected.
Files may be uploaded and executed.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress Contact Manager plugin's arbitrary file upload vulnerability requires action from application owners responsible for WordPress instances and potentially infrastructure or security teams to assess exposure. The first practical step is to inventory all WordPress sites, identify those using the Contact Manager plugin, and confirm their internet reachability and business criticality. This will inform a prioritized remediation plan, which may involve vendor coordination for a plugin update or temporary risk reduction measures.

WordPress application owners should lead remediation.
Verify plugin usage and internet exposure.
Plan updates or implement temporary controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Contact Manager plugin for WordPress?

Contact Manager is an extension for WordPress websites designed to facilitate communication between site visitors and administrators. It typically provides forms or interfaces for users to submit messages or inquiries directly through the site's frontend. Plugins like this are integral to managing user-generated content, though they also integrate directly into the server's file-handling processes.

What does CWE-434 mean regarding CVE-2026-109218?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the plugin fails to properly verify or filter the types of files users are allowed to upload. Because the software's blacklist can be bypassed using specific naming tricks, it mistakenly accepts files that should be blocked, allowing potentially malicious scripts to be saved to the server.

How can an attacker trigger this file upload bug?

An attacker exploits this by appending a trailing dot to a filename, which confuses the plugin's extension-checking routine into returning an empty string. The system then cleans the name, inadvertently removing the extension and allowing the file to be saved. This does not occur if the plugin correctly validates files against a complete whitelist rather than an incomplete blacklist.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high level of relevance because this plugin is designed to be public-facing. Since the vulnerable add_message function is accessible to unauthenticated users via the frontend, any standard WordPress deployment using this plugin is directly reachable from the internet, making this an external-facing concern by design.

What should I do if I run this plugin?

Begin by inventorying your WordPress installations to confirm if the Contact Manager plugin is active. Once identified, evaluate the plugin's necessity and check for official updates provided by the vendor. If an update is unavailable, consider temporarily disabling the plugin or restricting access to the affected forms until you can verify that the vulnerability is mitigated.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.