Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-104246
Unknown Contact Form 7 Signature Addon — Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H N N U H N N 5.9 .0016 5.3 —
AFFECTED
Product Versions Fixed
Contact Form 7 Signature Addon unspecified —
TIMELINE
Oct 1 Reserved by WPScan
Oct 17 Published (CNA: WPScan)
Oct 18 EXPLOIT PUBLISHED — CVE-2026-104246 (Unknown Contact Form 7 Signature Addon). Public exploit reference added.
Description
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a form is configured to email a copy to a submitter-controlled address, the attacker can read the targeted file.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 1, 2026 | Reserved | Reserved by WPScan |
| October 17, 2026 | Published | Published (CNA: WPScan) |
| October 18, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-104246 (Unknown Contact Form 7 Signature Addon). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Unknown | Contact Form 7 Signature Addon | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-104246 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
