Live › vulnerability › CVE-2026-104246
Go to dashboardThe Contact Form 7 Signature Addon WordPress plugin through 4.2.2 builds an email attachment path from an unsanitized signature field, so an unauthenticated visitor can traverse directories. On current Contact Form 7 the attacker can attach files under wp-content and, where the form emails a copy to the submitter, read the targeted file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Contact Form 7 Signature Addon plugin through version 4.2.2 with a form that includes a signature field and is configured to email a copy to a submitter-controlled address. The sources say the attachment is bounded to wp-content on current Contact Form 7, so sites without the addon or without that email setting are not exposed in the described way.
No product ranges from the sources yet.
wp plugin list --name=<plugin-slug>4.2.2; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.
This page as .md · .json · in your agent: get_signal("CVE-2026-104246")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.