Contact Form to Any API

Contact Form to Any API before 3.0.7 copies files submitted through contact forms into a publicly accessible directory without assigning random filenames. An unauthenticated attacker can enumerate predictable filenames and download files submitted by other users. The CNA does not disclose the contact-form integration, upload field, public directory, filename derivation, or enumeration request format.

Contact Form to Any API through 3.0.6 lets an authenticated Contributor store an attribute-breakout payload in the cf7anyapi_form_field post meta of a cf7_to_any_api configuration. When its mapping fields are loaded, the logged-in admin AJAX action cf7_to_any_api_get_form_field accepts form_id and post_id, reads that metadata, and concatenates each stored value directly into an HTML input value attribute without output escaping. Inserting the returned form-field HTML into the settings interface can therefore execute the stored script in a user's browser. The authoritative record does not disclose a more specific victim-navigation sequence.

Contact Form to Any API is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.0.3.

Contact Form to Any API is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Contact Form to Any API is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Contact Form to Any API is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Contact Form to Any API is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.