AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-18946

HIGH · CVSS 7.5 EPSS 0.26%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The Contact Form to Any API WordPress plugin versions prior to 3.0.7 are vulnerable due to improper file handling, which allows unauthenticated attackers to access and download user-submitted files from a publicly accessible directory. This exposure can lead to data leakage and privacy violations. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.

CVE
CVE-2026-18946
Severity
HIGH
CVSS
7.5
EPSS
0.26%
WordPress

Original NVD Description

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.