CVE-2026-109218

{
  "etk_id": "ETK-2026-2837",
  "cve_id": "CVE-2026-109218",
  "display_id": "CVE-2026-109218",
  "ghsa_id": "GHSA-gfc3-vp5h-pp8w",
  "euvd_id": "EUVD-2026-111608",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file upload in Contact Manager",
  "summary": "Contact Manager for WordPress through version 9.1.2 is affected by an unauthenticated arbitrary file upload flaw. An attacker may upload files that could be executable; code execution requires an Apache server using libapache2-mod-php and retrieval before the uploaded file is removed.",
  "mitigation": "Disable or remove the Contact Manager plugin until an updated release is available. Reduce exposure by preventing unauthenticated access to affected WordPress endpoints and avoiding Apache configurations that execute uploaded files.",
  "vendor": "kleor",
  "product": "Contact Manager",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 9.1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Contact Manager",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 73.28863935,
  "t0_at": "2026-10-28T06:45:19.576000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T08:17:22.001187+00:00",
      "days": 0.06391695818287037,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T06:45:19.576000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T06:45:19.576000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T06:45:19.576000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109218"
    }
  }
}