CVE-2026-104246: Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

Q: What configuration makes this vulnerability practically exploitable for file disclosure?

The affected form must be configured to send an email copy to an address controlled by the submitter. That allows an unauthenticated attacker to submit a traversal value in the signature field and receive the selected attachment by email.

Q: What files could an attacker access?

On current Contact Form 7, disclosure is bounded to files under the WordPress wp-content directory. The available data does not establish access to files outside that directory.

Q: How can I determine whether a site is affected?

Check whether Contact Form 7 Signature Addon is version 4.2.2 or earlier, and review its forms for email settings that send a copy to an address supplied by the form submitter. Forms without that delivery path do not provide the described mechanism for returning a targeted file to the attacker.

Q: What can be done if updating is not immediately possible?

Disable the affected signature functionality or prevent forms using it from emailing copies to submitter-controlled addresses. Restricting exposure of sensitive files within wp-content also reduces the impact of the described file-read boundary.

Published Oct 17, 2026

Updated

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.

Affected Software

1 affected component

Contact Form 7 Contact Form 7 Signature Addon<=4.2.2

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What configuration makes this vulnerability practically exploitable for file disclosure?

The affected form must be configured to send an email copy to an address controlled by the submitter. That allows an unauthenticated attacker to submit a traversal value in the signature field and receive the selected attachment by email.

What files could an attacker access?

On current Contact Form 7, disclosure is bounded to files under the WordPress wp-content directory. The available data does not establish access to files outside that directory.

How can I determine whether a site is affected?

Check whether Contact Form 7 Signature Addon is version 4.2.2 or earlier, and review its forms for email settings that send a copy to an address supplied by the form submitter. Forms without that delivery path do not provide the described mechanism for returning a targeted file to the attacker.

What can be done if updating is not immediately possible?

Disable the affected signature functionality or prevent forms using it from emailing copies to submitter-controlled addresses. Restricting exposure of sensitive files within wp-content also reduces the impact of the described file-read boundary.

CVE-2026-104246: Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

Affected Software

Event History

Frequently Asked Questions

What configuration makes this vulnerability practically exploitable for file disclosure?

What files could an attacker access?

How can I determine whether a site is affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What configuration makes this vulnerability practically exploitable for file disclosure?

What files could an attacker access?

How can I determine whether a site is affected?

What can be done if updating is not immediately possible?