Kiran Krishnakumar

**Name of the Vulnerable Software and Affected Versions** Contact Form 7 Signature Addon versions prior to 4.2.3 **Description** An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a technique used to access files and directories that are stored outside the web root folder—to attach arbitrary files from the `wp-content` directory to a form's outgoing email. If the form is configured to send a copy to an address controlled by the submitter, the attacker can read the targeted file. **Recommendations** Update Contact Form 7 Signature Addon to version 4.2.3 or later.