WordPress Contact Manager Plugin Arbitrary File Upload Vulnerability

The Contact Manager plugin for WordPress is vulnerable to an arbitrary file upload in all versions up to and including 9.1.2.

The flaw exists in the add_message function. An incomplete extension blacklist fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk.

This allows unauthenticated attackers to upload potentially executable files, leading to remote code execution. Successful exploitation additionally requires:

• The server to use Apache with libapache2-mod-php, which maps .phar to PHP by default.
• The attacker to retrieve the uploaded file before it is removed by unlink() at the end of the request.