WordPress Contact Manager Plugin Arbitrary File Upload

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Contact Manager plugin for WordPress contains a critical arbitrary file upload vulnerability (CVSS 9.8) affecting all versions through 9.1.2. The vulnerability exists in the add_message function where an incomplete extension blacklist fails to properly validate file uploads. By appending a trailing dot to filenames, attackers can exploit a logic flaw where the extension-derivation routine returns an empty string, which WordPress's sanitize_file_name() function then silently strips before writing the file to disk. This allows unauthenticated attackers to bypass security controls and upload malicious executable files—such as PHP shells—directly to the web server. Given the plugin's widespread use and the unauthenticated nature of the attack, this vulnerability poses an immediate risk to thousands of WordPress installations and enables complete server compromise.

Casky's 447 mapped skills leverage Claude AI's extended reasoning to identify the attack chain across three critical MITRE ATT&ACK phases: Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002). When analyzing this vulnerability, practitioners would observe detection patterns tracking file upload anomalies—specifically requests to the add_message endpoint with suspicious filename patterns containing trailing dots. Casky's skills recognize the sanitization bypass technique and flag the subsequent file system writes of executable content to web-accessible directories. The platform would correlate these indicators with typical post-exploitation behaviors: webshell instantiation, reverse shell callbacks, or privilege escalation attempts. Practitioners reviewing their Casky findings would see enriched context showing how initial file upload translates through persistence mechanisms into execution capabilities, enabling them to detect compromise at the earliest stage and respond before attackers establish foothold.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-109218.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-109218

Casky has 447 skills that investigate the attack patterns behind CVE-2026-109218. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn