Description

The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T07:16:50.720Z",
  "pubdate": "2026-08-10T07:16:50.720Z",
  "executiveSummary": "The Contact Form to Any API WordPress plugin, specifically versions prior to 3.0.7, suffers from an insecure file handling vulnerability that exposes user-submitted files to unauthorized third parties.\nThe vulnerability type is classified as predictable resource location leading to arbitrary file download. The impact includes the unauthorized disclosure of sensitive user data, personally identifiable information, or proprietary documents uploaded via contact forms.\nThe affected product is the Contact Form to Any API WordPress plugin in versions prior to 3.0.7. Risk implications are severe, as unauthorized data exposure can lead to privacy violations, compliance breaches, and secondary exploitation vectors.\nAttacker capabilities involve unauthenticated remote access, allowing malicious actors to systematically enumerate and exfiltrate files without holding any user privileges.\nExploitation requirements are minimal, requiring only network access to the target WordPress instance and the ability to guess or enumerate the predictable filenames generated during the form submission process.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure file handling mechanism implemented by the vulnerable component of the Contact Form to Any API plugin prior to version 3.0.7. When end users upload files through contact forms, the application processes these attachments and copies them into a publicly accessible directory on the web server.\nCrucially, the application fails to generate cryptographically secure, randomized filenames for the stored assets. Instead, it preserves predictable naming conventions or uses sequential identifiers that can be easily anticipated or brute-forced.\nThe exploitation method relies on reconnaissance and enumeration techniques. Because the destination directory lacks proper access controls and directory listing restrictions or utilizes guessable naming structures, unauthenticated threat actors can construct HTTP GET requests to query the publicly exposed paths directly.\nThe attack flow proceeds as follows: First, an attacker observes or infers the URL structure where uploaded files are stored by the plugin. Second, the attacker formulates a script to systematically iterate through potential filenames, timestamps, or sequential identifiers. Third, the attacker issues direct HTTP requests to the target web server targeting these predictable file paths. Finally, the server responds with HTTP 200 OK along with the requested file contents if the asset exists, granting the unauthenticated attacker direct access to download documents submitted by other users.\nThe affected versions include all releases of the Contact Form to Any API WordPress plugin strictly prior to version 3.0.7. Authentication and privilege requirements are entirely absent, meaning an unauthenticated attacker across the network can successfully exploit this vector without possessing any valid user account or administrative privileges.\nNetwork exposure is fully external, as the vulnerable file storage directory is accessible via standard HTTP/HTTPS protocols. The post-exploitation impact encompasses total compromise of confidentiality for all submitted file attachments, potentially exposing sensitive internal communications, personal data, or credentials uploaded through the affected contact forms."
}