CF7 Signature Addon EUVD-2026-103250

Exploitation requires the specific deployment condition that a Contact Form 7 form using the Signature Addon is configured to email a copy of the submission to a submitter-controlled recipient address (e.g., a 'send copy to submitter' mail configuration), since the attacker reads the file only via that outbound copy. The attacker must submit a signature field whose value contains path-traversal sequences that the plugin uses to construct the attachment path. Limiting factors: the arbitrary-read is bounded to the wp-content directory (not the full filesystem), and the attack only yields data when the submitter-controlled email-copy configuration is present - on default single-recipient (site-admin-only) forms the attacker does not receive the file, which is why CVSS rates attack complexity High. No authentication and no user interaction are required (PR:N/UI:N).

This is a moderate, conditional file-disclosure issue rather than a top-tier priority, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) correctly reflects a network-reachable, unauthenticated flaw whose real-world exploitability is gated by high attack complexity: the targeted form must be configured to email a copy of the submission to a submitter-controlled address, and the arbitrary-read is bounded to the wp-content directory (not the full filesystem or wp-config.php). No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is consistent with a newly disclosed (2026) WPScan-reported bug. The C:H rating is defensible because wp-content can hold backups, cached credentials, and uploaded sensitive files, but the wp-content boundary and the non-default email-to-submitter requirement meaningfully reduce practical impact. Net: a legitimate information-disclosure vulnerability worth patching on affected sites, but not a drop-everything emergency absent exploitation signals.

An attacker submits a Contact Form 7 form on a site running the Signature Addon (≤4.2.2) where the form is configured to email a copy of the submission to the submitter's own address. The attacker places path-traversal sequences in the signature field value so the plugin builds an attachment path pointing at a sensitive file within wp-content, and the server emails that file back to the attacker-controlled recipient. No public exploit code was identified in the provided data, but exploitation requires no authentication and no victim interaction.