CVE-2026-18946

The Contact Form to Any API WordPress plugin, in versions prior to 3.0.7 , is vulnerable to unauthenticated sensitive file disclosure via predictable filenames. The root cause is the failure to use random filenames when copying files uploaded through contact forms into a publicly accessible direc...