CVE-2026-18946 — Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

CVE-2026-18946

Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename PUBLISHED

Description (CNA)

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

Affected (CNA)

Vendor / product	Versions
Unknown / Contact Form to Any API	affected 0 before 3.0.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.