Vulnerability · Published Oct 17, 2026 · Assigned by WPScan

CVE-2026-104246Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

Medium 5.9

In plain English

A medium-severity path traversal in Contact Form 7 Signature Addon from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Contact Form 7 Signature Addon	0 – through 4.2.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/e56dc60b-9232-43f2-8d57-fe9452c85281/ exploit, vdb-entry, technical-description