WordPress Contact Form 7 Signature Addon plugin <= 4.2.2 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Kiran Krishnakumar in WordPress Plugin Contact Form 7 Signature Addon versions = 4.2.2...

CVE-2026-104246

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246

The Contact Form 7 Signature Addon WordPress plugin (versions through 4.2.2 ) is vulnerable to an unauthenticated arbitrary file read via path traversal . The root cause is the lack of sanitization for a signature field value when building an email attachment path. An attacker can attach arbitrar...

EUVD-2026-103250

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

PT-2026-116368

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...

CVE-2026-52694 WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce = 2.0 versions...

CVE-2025-62099

Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through = 1.8.6...

PT-2025-54392

Name of the Vulnerable Software and Affected Versions Approveme Signature Add-On for Gravity Forms versions through 1.8.6 Description The software contains a missing authorization issue due to incorrectly configured access control security levels. This allows for potential exploitation...