We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-18946

CVE-2026-18946

WordPress

Severity: HIGH
CVSS: 7.5CVSS
Published: 2026-08-10
Last modified: 2026-08-10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-200

Description

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

References

https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/

Summary

Description

References