Path Traversal Vulnerability in Contact Form 7 Signature Addon Plugin
CVE-2026-104246
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 October 2026
Badges
What is CVE-2026-104246?
The Contact Form 7 Signature Addon for WordPress, specifically up to version 4.2.2, is susceptible to a path traversal vulnerability. This occurs because the plugin fails to properly sanitize input from a signature field before using it to construct an email attachment path. Malicious users can exploit this weakness to attach unauthorized files from the server's wp-content directory to an email sent from the form. If the form is configured to send a copy to an address controlled by the attacker, they can gain read access to the targeted files, posing a significant security risk.
Affected Version(s)
Contact Form 7 Signature Addon 0 <= 4.2.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.