{"id":"CVE-2026-104246","aliases":["EUVD-2026-103250","GHSA-9vjv-8c2x-cq8c"],"status":"published","title":"Contact Form 7 Signature Addon \u003c= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments","description":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0028,"percentile":0.20759,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-17T06:00:12Z","modified":"2026-10-19T21:02:51Z","products":[{"vendor":"unknown","product":"contact form 7 signature addon"}],"references":[{"url":"https://wpscan.com/vulnerability/e56dc60b-9232-43f2-8d57-fe9452c85281/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104246"},{"url":"https://wpscan.com/vulnerability/e56dc60b-9232-43f2-8d57-fe9452c85281"},{"url":"https://github.com/advisories/GHSA-9vjv-8c2x-cq8c"}],"sources":{"cve":[{"id":"CVE-2026-104246","title":"Contact Form 7 Signature Addon \u003c= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments","description":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.","status":"published","published":"2026-10-17T06:00:12.551Z","modified":"2026-10-18T11:12:33.183Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-103250","description":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.","status":"published","published":"2026-10-17T06:00:12Z","modified":"2026-10-18T11:12:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:00.923575Z"}],"ghsa":[{"id":"GHSA-9vjv-8c2x-cq8c","title":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature...","description":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.","status":"published","published":"2026-10-17T06:30:33Z","modified":"2026-10-18T12:30:25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:13:54.281657Z"}],"nvd":[{"id":"CVE-2026-104246","description":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.","status":"published","published":"2026-10-17T06:16:33.347Z","modified":"2026-10-19T21:02:51.987Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:13:00.123071Z"}]}}