The Contact Manager plugin for WordPress allows unauthenticated users to submit files through a form without validating the file type. Attackers can therefore upload files with a double extension that may be interpreted by the server in a way that enables remote code execution in specific configurations that process the ultimate extension. The exploit also depends on a race condition that must be satisfied for the malicious file to be executed. The weakness is classified as CWE‑434: Unrestricted Upload of File with Dangerous Type.

The vulnerability affects all installations of the Contact Manager plugin by kleor with versions 8.6.4 and earlier. This includes any WordPress site that has the plugin installed at these or lower versions.

With a CVSS score of 8.1 the vulnerability is considered high severity. The EPSS score of 3 % indicates a moderate likelihood that the flaw will be exploited in the near term. It is not listed in CISA’s KEV catalog. The most likely attack vector is a network‑based, unauthenticated submission through the public contact form. While the race condition requirement raises the difficulty, the vulnerability can still be leveraged in configurations that allow the second file extension to be executed, making remote code execution feasible.