WordPress Contact Form to Any API < 3.0.7 Unauthenticated Sensitive File Disclosure CVE-2026-18946

Vulnerability Overview Vulnerability Name: Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename Description: The plugin does not use random filenames when uploading files via the contact form to a publicly accessible directory, allowing unauthorized attackers to enumerate and download files submitted by other users. CVE ID: CVE-2026-18946 Classification: - Type: SENSITIVE DATA DISCLOSURE - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 5.3 (medium) Impact Scope Affected Plugin: contact-form-to-any-api Fixed Version: 3.0.7 Remediation Fixed Version: Upgrade to version 3.0.7 or higher. Timeline Public Disclosure Date: 2026-08-06 Date Added: 2026-08-06 Last Updated: 2026-08-06 Additional Information Original Researcher: Farid Narimanov Submitter: Farid Narimanov Submitter Website: https://faridnarimanov.com Submitter Twitter: FaridNarimanov Verification Status: Yes WPVDB ID: fa13ebbb-8eea-492d-8f59-58228efb94d8 Related Vulnerabilities InfiniteWP Client < 1.12.31 - Unauthenticated Sensitive Information Exposure (2024-02-08) WP Meta SEO < 4.5.13 - Unauthenticated Password Protected Content Access (2024-04-16) WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments (2020-06-11) Mollie Payments for WooCommerce < 7.8.0 - Unauthenticated Full Path Disclosure (2024-08-27) WP Import Export < 3.9.16 - Unauthenticated Sensitive Data Disclosure (2022-01-14) POC Code POC Code: No specific POC code is provided in the page, but it mentions that the POC will be demonstrated on 2026-08-20, giving users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Contact Form to Any API < 3.0.7 Unauthenticated Sensitive File Disclosure CVE-2026-18946

More from this source