Contact Manager CVE-2026-109218

The arbitrary file upload itself requires no authentication (PR:N) and is reachable remotely via the plugin's contact form add_message handler in Contact Manager ≤9.1.2; the trigger is an uploaded filename ending in a trailing dot, which makes the extension-derivation routine return an empty string so the incomplete blacklist is bypassed and sanitize_file_name() strips the dot before writing. Full remote code execution is gated by two concrete conditions stated in the description: (1) the server must run Apache with libapache2-mod-php, which maps .phar to PHP by default - deployments on nginx/php-fpm or without that mapping do not get code execution from this path; and (2) the attacker must retrieve the uploaded file within the brief window before unlink() removes it at the end of the request, i.e. win a timing race. These two factors are the main limiters: on non-Apache/mod_php stacks the impact degrades to an unauthenticated file-write rather than RCE, and the deletion race reduces reliability.

Signals are mostly aligned toward elevated but not catastrophic urgency. The vuln.today decision label is act_now, the finding was reported by a credible source (Wordfence), and the input CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N, meaning the underlying arbitrary file write is reachable by unauthenticated network attackers against the plugin's public contact form. However, the 9.8 overstates real-world RCE reliability: the description itself conditions code execution on two factors that the CVSS AC:L does not capture - the server must run Apache with libapache2-mod-php (which maps .phar to PHP by default; nginx/php-fpm and most managed hosts do not), and the attacker must retrieve the uploaded file within a brief window before unlink() deletes it at end of request. So the file-write primitive is reliable and unauthenticated, but the full RCE is config-dependent and involves a timing race, making it closer to a targeted-opportunity bug than mass-exploitable on arbitrary hosts. No EPSS score was provided, so exploitation probability cannot be quantified. There is no KEV listing and no verified exploit code in the input, so there is no public exploit identified at time of analysis - this is a priority to patch because of the act_now label and unauthenticated reachability, but the headline 9.8 should be read with the Apache/mod_php and race-window caveats in mind.

An unauthenticated attacker submits the plugin's public contact form, invoking add_message with a file whose name ends in a trailing dot; the incomplete extension blacklist derives an empty extension, sanitize_file_name() silently strips the dot, and a .phar (or otherwise executable) payload is written to disk. On a server using Apache with libapache2-mod-php, the attacker then races to request the uploaded file before unlink() removes it at end of request, causing PHP execution and remote code execution. No public exploit identified at time of analysis; this scenario is derived from the Wordfence/CVE description and the AV:N/AC:L/PR:N vector.