---
id: CVE-2026-104246
title: >-
  Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read
  via Path Traversal in Email Attachments
summary: >-
  The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not
  sanitize a signature field value before building an email attachment path from
  it, allowing unauthenticated users to attach arbitrary files (bounded to
  wp-content…
severity: none
cwe:
  - CWE-22
product: Contact Form 7 Signature Addon
affected:
  - contact_form_7_signature_addon <= 4.2.2
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T06:00:12.551Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104246'
references:
  - url: 'https://wpscan.com/vulnerability/e56dc60b-9232-43f2-8d57-fe9452c85281/'
tags:
  - cve.org
ingestedAt: '2026-10-17T07:01:26.053Z'
---

## Overview

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.

## Affected

- `contact_form_7_signature_addon <= 4.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.