{
 "id": "WPSEC-2026-1457",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1457/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1457/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1457/index.md",
 "title": "WordPress Contact Forms by Cimatti <= 2.3.6 - Unauthenticated Insecure Direct Object Reference to Submitted File Download",
 "description": "The Contact Forms by Cimatti plugin for WordPress is vulnerable to Insecure Direct Object Reference via the accua_forms_download_submitted_file AJAX action in all versions up to, and including, 2.3.6, due to downloads being authorized by a generic 'accua_forms_download_nonce' nonce instead of the submission's own secret token. For logged-out visitors this nonce is the same for everyone, and the plugin puts it into every file download link it builds while processing a submission. This makes it possible for unauthenticated attackers who receive such a link for their own submission, for example in an autoreply e-mail or success message that includes the submitted data, to download files uploaded with other visitors' submissions by changing the sequential submission ID, the field and the file name in the URL.",
 "plugin": {
  "slug": "contact-forms",
  "name": "WordPress Contact Forms by Cimatti",
  "full_name": "Contact Forms by Cimatti",
  "wordpress_org": "https://wordpress.org/plugins/contact-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contact-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contact-forms"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.3.32",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.3.32"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.3.32",
 "remediation": "Update to 2.3.32 or later.",
 "fix_released": "2026-10-21T13:26:58+00:00",
 "published": "2026-10-22T13:52:08+00:00",
 "updated": "2026-10-22T09:33:22.530958+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1457/",
  "https://plugins.svn.wordpress.org/contact-forms/tags/2.3.32/",
  "https://wordpress.org/plugins/contact-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contact-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}