CVE-2025-1028 describes an unrestricted file upload vulnerability in the kleor Contact Manager WordPress plugin. The vulnerability arises from the lack of file type validation in the contact form upload feature, allowing unauthenticated attackers to upload arbitrary files. Exploitation requires successfully exploiting a race condition and depends on specific server configurations that process the first file extension rather than the final extension, potentially enabling remote code execution. The vulnerability affects all versions up to and including 8.6.4. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary file uploads on the affected server, which in specific configurations may result in remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability does not require authentication but requires a race condition exploit, increasing attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the file upload feature in the Contact Manager plugin or restricting file upload permissions at the server level to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.