CVE-2026-110383
7.5HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-639
Impact
Unauthenticated remote attackers can view sensitive contract and signature data without logging in. All they need is network access to send crafted requests manipulating object identifiers.
Root cause
The plugin fails to validate user permissions before serving objects based on user-supplied keys (insecure direct object references).
Affected systems
WP E-Signature Electronic Signature Add-on for Fluent Forms (signature-fluent-contract-forms-add-on) through version 2.0.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade to a version later than 2.0.5 once available, or deactivate and remove the plugin immediately if patching is not an option.
$ wp plugin deactivate signature-fluent-contract-forms-add-onAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.