CVE-2026-104246 Contact Form 7 Signature Addon CVE debrief

Who should care

Defenders responsible for WordPress installations with the Contact Form 7 Signature Addon plugin should assess exposure and verify file attachment handling. This includes reviewing plugin versions, email configurations, and monitoring for suspicious file attachment attempts. Security teams and vulnerability management teams should prioritize remediation based on the potential impact of this vulnerability on their systems.

Why it matters

CVE-2026-104246 allows unauthenticated file attachment via path traversal in the Contact Form 7 Signature Addon WordPress plugin. Defenders should assess exposure, verify file attachment handling, and update the plugin if necessary.

• Potential unauthorized file access via email
• Possible exploitation requires verification
• Defenders should verify plugin version and email configuration
• Remediation priority is moderate

Technical summary

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 is vulnerable to path traversal. This vulnerability allows unauthenticated users to attach arbitrary files to a form's outgoing email. The plugin does not properly sanitize the signature field value before using it to build an email attachment path. This can lead to potential unauthorized file access via email. Defenders should assess exposure and verify file attachment handling to mitigate this vulnerability. The vulnerability has been publicly disclosed and has a moderate severity.

Defensive priority

Assess exposure and verify file attachment handling.

Recommended defensive actions

• Review Contact Form 7 Signature Addon plugin version and update if necessary
• Verify file attachment handling and email configuration
• Monitor for suspicious file attachment attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via path traversal. When a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impact

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.