An unauthenticated attacker can submit a form containing specially crafted signature data that contains directory traversal sequences. The plugin fails to sanitize this input when constructing the file path for an email attachment, enabling the inclusion of arbitrary files located within the site's wp-content directory. The resulting email, when sent to a victim's address, exposes the contents of the targeted file, thereby allowing disclosure of sensitive data. This flaw is a classic input validation and path traversal weakness, directly leading to unauthorized information disclosure.

WordPress sites using the Contact Form 7 Signature Addon plugin version 4.2.2 or earlier are susceptible. The vulnerability affects the plugin's attachment handling routine, which is invoked when a form is configured to email a copy to the submitter's address. The path traversal is only bounded to files under the wp-content directory, but the lack of sanitization permits reading any such file.

The path traversal flaw presents a high risk because it requires no authentication and can be triggered simply by submitting a crafted form. While no CVSS or EPSS score is available, the potential for arbitrary file disclosure indicates a significant threat. The attack vector is likely through normal form submissions that the plugin processes, and the attacker does not need elevated privileges. Since the vulnerability is not listed in KEV, it may currently lack publicly known exploits, but the inherent severity warrants prompt attention.