Vulnerability in Contact Form To Any Api

CVE-2026-18946

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download f…

Affected products

  • Unknown Contact Form To Any Api — versions 0

References