CVE-2026-18946

The CVE-2026-18946 entry concerns the WordPress plugin “Contact Form to Any API” (pre-3.0.7). The root cause is that file uploads copied via contact forms are stored with non-random, predictable filenames in a publicly accessible directory, enabling unauthenticated attackers to enumerate and down...