CVE-2026-104246
Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.
| Vendor | unknown |
| Product | contact form 7 signature addon |
| Published | Oct 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown contact form 7 signature addon
Be the first to know when new unknown vulnerabilities affecting unknown contact form 7 signature addon are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Contact Form 7 Signature Addon
0 ≤ 4.2.2
References
Credits
Kiran Krishnakumar WPScan