CVE-2026-104246

Received Received - Intake

Path Traversal in Contact Form 7 Signature Addon

Publication date: 2026-10-17

Last updated on: 2026-10-18

Assigner: WPScan

Description

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-17

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-17

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104246

EUVD

EUVD-2026-103250

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Contact	Form 7 Signature Addon 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Contact Form 7 Signature Addon WordPress plugin (version 4.2.2 or earlier). It allows unauthenticated users to read arbitrary files within the wp-content directory by exploiting a path traversal flaw in the signature field. Attackers manipulate file paths in email attachments to access sensitive files when forms are configured to send attachments to attacker-controlled email addresses.

Detection Guidance

Check if the Contact Form 7 Signature Addon plugin version 4.2.2 or earlier is installed. Inspect form configurations for email attachments and verify if user-controlled signature fields could manipulate file paths.

Impact Analysis

If you use the vulnerable plugin, attackers could read sensitive files on your WordPress site, such as configuration files, logs, or other stored data within wp-content. This could lead to data breaches, exposure of credentials, or further compromise of your site if attackers gain access to critical files.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data stored in the wp-content directory. Organizations may face legal penalties, fines, or reputational damage due to data exposure.

Mitigation Strategies

Update the Contact Form 7 Signature Addon plugin to the latest version immediately. Disable email attachments in forms if not required. Review and restrict file access permissions in wp-content.

Hi! I’m here to help you understand CVE-2026-104246. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70