CVE-2026-104246

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3

Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a technique used to access files and directories that are stored outside the web root folder—to attach arbitrary files from the wp-content directory to a form's outgoing email. If the form is configured to send a copy to an address controlled by the submitter, the attacker can read the targeted file.

Recommendations Update Contact Form 7 Signature Addon to version 4.2.3 or later.