EUVD-2026-55012
GHSA-qp64-vw92-jr32
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable with no authentication or user interaction; purely a confidentiality impact with no integrity or availability effect, consistent with passive file enumeration.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
Articles & Coverage 1
AnalysisAI
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Contact Form to Any API plugin be installed and active on a WordPress site running a version prior to 3.0.7, and that at least one contact form on the site accepts file attachments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects the unauthenticated, low-complexity, network-accessible nature of this vulnerability with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a benign file through the public contact form on a target WordPress site, observing the returned or stored URL to identify the upload directory path and filename pattern. They then iterate over predictable filename variants - sequential integers, timestamps, or other enumerable schemes - issuing direct HTTP GET requests to retrieve files uploaded by prior legitimate users. … |
| Remediation | Update the Contact Form to Any API plugin to version 3.0.7 or later, which resolves the issue by introducing randomized filenames for uploaded attachments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using Contact Form to Any API and their current versions; prioritize patches for any deployment handling regulated data (PII, PHI, or payment information). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Contact Form To Any Api
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fi
Unauthenticated reflected/stored cross-site scripting in the WordPress plugin Contact Form to Any API through version 3.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today