The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a… (CVE-2026-18946)
The Contact Form to Any API WordPress plugin versions before 3.0.7 do not use random filenames when copying uploaded files to a publicly accessible directory. This allows unauthenticated attackers to enumerate and download files submitted by other users through contact forms.
AI Analysis
Technical Summary
A vulnerability in the Contact Form to Any API WordPress plugin prior to version 3.0.7 involves the lack of randomization in filenames for files uploaded via contact forms. Uploaded files are copied into a publicly accessible directory with predictable filenames, enabling unauthenticated attackers to enumerate and access files submitted by other users.
Potential Impact
Unauthenticated attackers can enumerate and download files uploaded by other users through contact forms. This may lead to unauthorized disclosure of sensitive or private information contained in those files.
Mitigation Recommendations
Upgrade the Contact Form to Any API WordPress plugin to version 3.0.7 or later, where this issue is fixed by using random filenames for uploaded files. No other mitigation guidance is provided.
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a… (CVE-2026-18946)
Description
The Contact Form to Any API WordPress plugin versions before 3.0.7 do not use random filenames when copying uploaded files to a publicly accessible directory. This allows unauthenticated attackers to enumerate and download files submitted by other users through contact forms.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A vulnerability in the Contact Form to Any API WordPress plugin prior to version 3.0.7 involves the lack of randomization in filenames for files uploaded via contact forms. Uploaded files are copied into a publicly accessible directory with predictable filenames, enabling unauthenticated attackers to enumerate and access files submitted by other users.
Potential Impact
Unauthenticated attackers can enumerate and download files uploaded by other users through contact forms. This may lead to unauthorized disclosure of sensitive or private information contained in those files.
Mitigation Recommendations
Upgrade the Contact Form to Any API WordPress plugin to version 3.0.7 or later, where this issue is fixed by using random filenames for uploaded files. No other mitigation guidance is provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qp64-vw92-jr32
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18946"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a79f0e1bf8831d539f62bac
Added to database: 08/10/2026, 15:40:17 UTC
Last enriched: 08/10/2026, 16:04:15 UTC
Last updated: 08/11/2026, 03:41:00 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.