CVE-2026-18946 PUBLISHED

Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

Assigner: WPScan
Reserved: 05.08.2026 Published: 10.08.2026 Updated: 10.08.2026

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

Product Status

Vendor Unknown
Product Contact Form to Any API
Versions Default: unaffected
  • affected from 0 to 3.0.7 (excl.)

Credits

  • Farid Narimanov finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE