Path Traversal Vulnerability in Contact Form 7 Signature Addon Plugin
CVE-2026-104246

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Contact Form 7 Signature Addon
Vendor
CVE Published:
17 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104246?

The Contact Form 7 Signature Addon for WordPress, specifically up to version 4.2.2, is susceptible to a path traversal vulnerability. This occurs because the plugin fails to properly sanitize input from a signature field before using it to construct an email attachment path. Malicious users can exploit this weakness to attach unauthorized files from the server's wp-content directory to an email sent from the form. If the form is configured to send a copy to an address controlled by the attacker, they can gain read access to the targeted files, posing a significant security risk.

Affected Version(s)

Contact Form 7 Signature Addon 0 <= 4.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104246 - Proof of Concept

References

https://wpscan.com/vulnerability/e56dc60b-9232-43f2-8d57-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kiran Krishnakumar
WPScan
.