CVE-2026-18946
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Contact Form to Any API plugin before version 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
Risk Assessment
An attacker can access files submitted by other users, potentially leading to disclosure of confidential information.
Recommendation
Update the plugin to version 3.0.7 or later.
Other vulnerabilities in Contact Form to Any API
See all- CVE-2026-15735Medium
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7anyapi_form_field' Post Meta in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping.
- CVE-2026-39449High
Versions of Contact Form to Any API <= 3.0.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
Original NVD description (English source)
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.