CVE-2026-18946
Received Received - Intake

Contact Form to Any API File Enumeration Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-18946
EUVD
EUVD-2026-55012

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpforms contact_form_to_any_api to 3.0.7 (exc)
contact_form_to_any_api contact_form_to_any_api to 3.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Contact Form to Any API WordPress plugin before version 3.0.7. It allows unauthenticated attackers to access files uploaded through contact forms by exploiting predictable filenames stored in a public directory. Attackers can enumerate and download files submitted by other users without needing authentication.

Detection Guidance

Check if the Contact Form to Any API WordPress plugin is installed and verify its version. If it is below 3.0.7, the system is vulnerable. Inspect the plugin's file storage directory for predictable filenames that could be enumerated.

Impact Analysis

If you use this plugin, attackers could access sensitive files uploaded via contact forms, such as documents or personal information submitted by you or your users. This could lead to data breaches, privacy violations, or unauthorized access to confidential data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other privacy regulations due to unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, and loss of trust if such breaches occur.

Mitigation Strategies

Update the Contact Form to Any API WordPress plugin to version 3.0.7 or later immediately. Remove any sensitive files stored in the plugin's public directory and restrict access to the directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18946. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart