The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path… (CVE-2026-104246)

CVE-2026-104246 describes a path traversal vulnerability in the Contact Form 7 Signature Addon WordPress plugin versions through 4.2.2. The plugin fails to sanitize the signature field value before constructing the file path for email attachments. This flaw enables unauthenticated attackers to specify arbitrary files within the wp-content directory to be attached to emails sent by the form. When the form is set to email a copy to an address controlled by the attacker, this can lead to unauthorized disclosure of file contents. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impact to confidentiality only.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files within the wp-content directory by attaching them to emails sent by the form. This results in unauthorized disclosure of potentially sensitive information. There is no impact on integrity or availability. The attack requires high complexity and no privileges or user interaction.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the Contact Form 7 Signature Addon plugin or restricting access to the form to trusted users only to mitigate exploitation risk.