What is GHSA-qp64-vw92-jr32?

GHSA-qp64-vw92-jr32 is a security advisory published by GitHub Security Advisories with High severity. The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when...

Which CVE IDs does GHSA-qp64-vw92-jr32 cover?

GHSA-qp64-vw92-jr32 covers the following CVE IDs: CVE-2026-18946. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qp64-vw92-jr32?

GHSA-qp64-vw92-jr32 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-qp64-vw92-jr32HighCVSS 7.5

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-18946 →

📋 Description

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18946
https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8
https://github.com/advisories/GHSA-qp64-vw92-jr32