Contact Form to Any API EUVD-2026-55012

Exploitation requires that the Contact Form to Any API plugin be installed and active on a WordPress site running a version prior to 3.0.7, and that at least one contact form on the site accepts file attachments. The attacker must have unauthenticated HTTP access to the WordPress site (AV:N, PR:N per the confirmed CVSS vector). No special server-side configuration is required to be vulnerable - the flaw is in the plugin's default behavior. Exploitation is naturally limited to sites where users are actively submitting files via the affected contact forms; a site with no file upload forms or no actual file submissions provides nothing to enumerate. Additionally, if an administrator has independently restricted web server access to the plugin's upload subdirectory, exposure is mitigated regardless of plugin version.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects the unauthenticated, low-complexity, network-accessible nature of this vulnerability with high confidentiality impact. However, the EPSS score of 0.14% at the 4th percentile indicates that automated exploitation is not currently widespread - a meaningful contrast to the high CVSS. This divergence likely reflects the plugin's relatively niche install base rather than difficulty of exploitation, since the attack itself is trivially simple given the public POC. The vulnerability is not listed in CISA KEV, so confirmed active exploitation cannot be asserted. That said, the availability of a documented POC via WPScan significantly lowers the attacker skill threshold, and sites collecting sensitive file uploads (legal, medical, financial contexts) face disproportionate real-world impact if exploited. The absence of KEV and low EPSS suggest opportunistic rather than targeted exploitation at present.

An attacker submits a benign file through the public contact form on a target WordPress site, observing the returned or stored URL to identify the upload directory path and filename pattern. They then iterate over predictable filename variants - sequential integers, timestamps, or other enumerable schemes - issuing direct HTTP GET requests to retrieve files uploaded by prior legitimate users. With a publicly available POC documented by WPScan, this enumeration technique requires no specialized tooling and can be automated with basic scripting.