WordPress Plugin Vulnerabilities

Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename

Description

The plugin does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

Proof of Concept

Affects Plugins

Plugin icon
contact-form-to-any-api
Fixed in 3.0.7

References

CVE
CVE-2026-18946

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Farid Narimanov
Submitter
Farid Narimanov
Submitter website
https://faridnarimanov.com
Submitter twitter
FaridNarimanov
Verified
Yes
WPVDB ID
fa13ebbb-8eea-492d-8f59-58228efb94d8

Timeline

Publicly Published
2026-08-06 (about 4 days ago)
Added
2026-08-06 (about 3 days ago)
Last Updated
2026-08-06 (about 3 days ago)

Other

Published
Title
Published
2026-07-23
Title
PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure
Published
2023-09-11
Title
WooCommerce < 7.0.1 - Authenticated(Shop Manager+) Sensitive Information Exposure
Published
2024-02-26
Title
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure
Published
2026-06-10
Title
JetBlog < 2.4.8.1 - Unauthenticated Information Exposure
Published
2026-02-02
Title
Tutor LMS < 3.9.6 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action