CVE-2026-18946

The vulnerable plugin stores uploaded files in a publicly accessible directory using their original filenames. An attacker can enumerate the directory and retrieve any file a user has submitted through the contact form — including files containing sensitive data the user attached (PII, credentials, documents). The fix is straightforward: replace the direct use of `$file['name']` with `wp_unique_filename($dir, $file['name'])` to randomize the stored filename while preserving the original for display purposes if needed. Check whether your plugin's upload handler passes the user-submitted filename directly to `move_uploaded_file()` or `wp_upload_bits()` without randomization. Look specifically for code paths handling form submissions where the uploaded file becomes accessible via a web URL. Even if you've implemented other security measures (file type validation, sanitization), this enumeration vector may persist if the filename itself is predictable. The reason this pattern keeps recurring across WordPress plugins and similar frameworks is structural, not accidental. Preserving original filenames is the intuitive path — it's what the filesystem APIs make easy, it aids user debugging, and it avoids support tickets from confused users who can't find their files. Randomizing filenames requires active effort and knowledge of the secure API. WordPress provides `wp_unique_filename()`, but it's not the default and the security implications of the insecure alternative aren't highlighted in the documentation. This matters for prioritization: because the fix is trivial, defenders should treat this as a high-priority patch. The exposure window for enumeration vulnerabilities tends to be longer than for code execution because the harm is diffuse — no one notices predictable filenames until an attacker demonstrates the problem. If you're on an affected version, patch immediately. If you manage multiple WordPress deployments, audit any custom or third-party plugins that handle file uploads for this exact pattern — recurrence data shows this vulnerability class reappears across plugins with alarming consistency.

Reviewed through automated stages and approved by a human before publication.