CVE-2026-18946 is an information exposure vulnerability (CWE-200) in the Contact Form to Any API WordPress plugin versions prior to 3.0.7. The plugin copies files uploaded through contact forms into a publicly accessible directory without using random filenames. This predictable file naming enables unauthenticated attackers to enumerate and download files submitted by other users, exposing potentially sensitive information. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Unauthenticated attackers can access and download files uploaded by other users via the contact form, potentially exposing sensitive or private information. This compromises confidentiality but does not affect integrity or availability of the system.

A fixed version 3.0.7 or later is implied but not explicitly confirmed in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is applied, restrict access to the upload directory or implement additional access controls to prevent unauthorized file enumeration and download.