The Contact Manager plugin for WordPress has a flaw in its add_message function that allows an attacker to upload files with arbitrary content. The flaw stems from an incomplete extension blacklist that does not detect dangerous extensions when a trailing dot is used; the extension derivation routine returns an empty string and sanitize_file_name() silently removes it, enabling the file to be written to disk. If the uploaded file is executable, the attacker can leverage it to run arbitrary code. Attackers do not need authentication to trigger the upload.

This issue affects the Contact Manager plugin, versions 9.1.2 and earlier, which is distributed by kleor. The plugin is used in WordPress installations worldwide.

The vulnerability has a CVSS score of 9.8, indicating a critical severity. While the EPSS score is not available, the exploitation of the flaw requires only a standard HTTP request and is trivial for unauthenticated users. The weakness is not yet listed in the CISA KEV catalog. Successful exploitation also requires the target web server to run Apache with libapache2-mod-php, which maps the .phar extension to PHP, and the attacker must retrieve the file before the script deletes it with unlink, which creates a short execution window.