An unauthenticated attacker can submit a form containing specially crafted signature data that contains directory traversal sequences. The plugin fails to sanitize this input when constructing the file path for an email attachment, enabling the inclusion of arbitrary files located within the site's wp-content directory. The resulting email, when sent to a victim's address, exposes the contents of the targeted file, thereby allowing disclosure of sensitive data. This flaw is a classic input validation and path traversal weakness, directly leading to unauthorized information disclosure.

WordPress sites using the Contact Form 7 Signature Addon plugin version 4.2.2 or earlier are susceptible. The vulnerability affects the plugin's attachment handling routine, which is invoked when a form is configured to email a copy to the submitter-controlled address. The path traversal is only bounded to files under the wp-content directory, but the lack of sanitization permits reading any such file.

The path traversal flaw presents a moderate risk, with a CVSS score of 5.9 and an EPSS score of <1%. Because no authentication is required, an attacker can trigger it simply by submitting a crafted form. The resulting email may expose arbitrary files located under the site's wp-content directory when a form is configured to send a copy to a submitter-controlled address. The vulnerability is not listed in the CISA KEV catalog, indicating that publicly known exploits are likely not yet available. Nonetheless, the potential for sensitive data disclosure warrants timely remediation.