CVE-2026-104246: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Contact Form 7 Signature Addon

CVE-2026-104246 is a path traversal vulnerability (CWE-22) in the Contact Form 7 Signature Addon WordPress plugin through version 4.2.2. The plugin fails to sanitize the signature field before constructing the email attachment path, enabling unauthenticated attackers to attach arbitrary files from the server's wp-content directory to emails sent by the form. When the form configuration includes emailing a copy to an attacker-controlled address, this can lead to unauthorized file disclosure.

An attacker can read arbitrary files within the wp-content directory on the affected server by exploiting the path traversal flaw to attach files to outgoing emails. This can lead to sensitive information disclosure if the form is configured to send copies of submissions to an attacker-controlled email address.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring forms to send copies of submissions to submitter-controlled email addresses and consider disabling the signature attachment feature if possible.