CVE-2026-18946
Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
| Vendor | unknown |
| Product | contact form to any api |
| Published | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown contact form to any api
Be the first to know when new unknown vulnerabilities affecting unknown contact form to any api are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Contact Form to Any API
0 < 3.0.7
References
Credits
Farid Narimanov WPScan