# WordPress Contact Forms by Cimatti <= 2.3.6 - Unauthenticated Insecure Direct Object Reference to Submitted File Download

- **ID:** WPSEC-2026-1457
- **Plugin:** Contact Forms by Cimatti (`contact-forms`), https://wordpress.org/plugins/contact-forms/
- **Affected versions:** all versions before 2.3.32
- **Fixed in:** 2.3.32 (Update to 2.3.32 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contact-forms
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1457/

## Description

The Contact Forms by Cimatti plugin for WordPress is vulnerable to Insecure Direct Object Reference via the accua_forms_download_submitted_file AJAX action in all versions up to, and including, 2.3.6, due to downloads being authorized by a generic 'accua_forms_download_nonce' nonce instead of the submission's own secret token. For logged-out visitors this nonce is the same for everyone, and the plugin puts it into every file download link it builds while processing a submission. This makes it possible for unauthenticated attackers who receive such a link for their own submission, for example in an autoreply e-mail or success message that includes the submitted data, to download files uploaded with other visitors' submissions by changing the sequential submission ID, the field and the file name in the URL.

## References

- https://wpsec.com/vuln/WPSEC-2026-1457/
- https://plugins.svn.wordpress.org/contact-forms/tags/2.3.32/
- https://wordpress.org/plugins/contact-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1457/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.