high7.5
CVE-2026-18946
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly acce…
Impact
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
Affected products
| Product | Affected versions |
|---|---|
| Contact Form To Any API WordPress Plugin | before 3.0.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.