CVE-2026-104246 in Contact Form 7 Signature Addon Plugin
Summary
by MITRE • 10/17/2026
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in the Contact Form 7 Signature Addon plugin for WordPress versions through 4.2.2 represents a critical server-side request forgery and path traversal flaw that compromises data integrity and confidentiality. This security defect stems from an insufficient sanitization of user-supplied input within the signature field processing logic. Specifically, when a form is configured to send an email copy to an address controlled by the submitter, the plugin constructs a file path for attaching a generated image or document based on the value provided in this specific field. The developer failed to validate or escape special characters that are typically used in directory traversal attacks, such as dot-dot-slash sequences. This oversight allows an unauthenticated attacker to manipulate the internal file system references embedded within the email attachment mechanism.
From a technical perspective, the core issue lies in the improper neutralization of special elements used in paths, commonly categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. By injecting path traversal sequences into the signature field, an attacker can break out of the intended directory scope and reference files located elsewhere on the server or within accessible subdirectories like wp-content. The plugin's logic blindly trusts this input when building the attachment path for outgoing emails. Consequently, instead of attaching only the expected generated content from the form submission, the mail function is instructed to include arbitrary local files as attachments in the email message sent to the attacker-controlled address.
The operational impact of this vulnerability is severe, primarily affecting data confidentiality and potentially leading to unauthorized access to sensitive system information. Since WordPress installations often store configuration files, database credentials, source code, or other proprietary assets within accessible directories such as wp-content, an attacker can exploit this flaw to exfiltrate these resources. By reading the targeted file contents through the email delivery mechanism, the attacker gains insight into the internal structure of the web application and its hosting environment. This information disclosure can serve as a stepping stone for further attacks, including credential theft or deeper system compromise, especially if sensitive configuration files containing database passwords are successfully retrieved.
This vulnerability aligns with several known attack patterns documented in industry standards. It is directly associated with CWE-20: Improper Input Validation and CWE-78: OS Command Injection principles regarding path manipulation. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving Local File Inclusion or Path Traversal used for Data Staging and Exfiltration over Email protocols. The lack of input validation allows the attacker to bypass intended access controls defined by the web server's document root restrictions, effectively elevating their ability to read files that should remain private from public-facing users.
To mitigate this vulnerability, immediate action is required to update the Contact Form 7 Signature Addon plugin to version 4.2.3 or later, where these input sanitization issues have been addressed by the developers. Administrators who cannot immediately patch their systems should implement strict server-side validation rules that reject any input containing path traversal sequences such as ../ or ..\ in form fields intended for file operations. Additionally, configuring web servers to restrict write permissions and limit read access to sensitive directories can reduce the blast radius of successful exploitation events. Regular security audits focusing on user input handling in email generation functions are recommended to prevent similar logic flaws in other plugins that process dynamic content for outgoing communications.