{"id":"CVE-2026-18946","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-18946","summary":"The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing…","details":"The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.","published":"2026-08-10T07:16:50.720","modified":"2026-08-10T07:16:50.720","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-10T07:16:50.720"}}