CVE-2025-1028

Summary

CVE-2025-1028 is a vulnerability in the Contact Manager plugin for WordPress, affecting versions up to 8.6.4. The issue stems from missing file type validation in the contact form upload feature, enabling unauthenticated attackers to upload arbitrary files to the server. There's a potential for remote code execution in certain configurations, where the first extension is processed instead of the final one. However, exploitation requires the successful manipulation of a race condition.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.