CVE-2026-18946

The CVE-2026-18946 affects the WordPress plugin “Contact Form to Any API” prior to version 3.0.7. The root cause is non-random filenames when saving files uploaded via contact forms to a publicly accessible directory, enabling unauthenticated attackers to enumerate and download other users’ submi...