CVE-2026-110383: WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
signature-fluent-contract-forms-add-onto a version that resolves this vulnerability.Fixed in 2.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that the vulnerability can be exploited remotely with low attack complexity, without authentication or user interaction. It affects installations of the Electronic Signature Add-on for Fluent Forms through version 2.0.5.
What is the likely impact of successful exploitation?
Successful exploitation can expose confidential information. The supplied CVSS vector rates confidentiality impact as high and does not indicate integrity or availability impact.
Are default installations affected?
The available information identifies incorrectly configured access-control security levels as part of the issue, but does not state whether a default installation is vulnerable. Verify the installed add-on version and review access controls around signature and contract form resources.
How can I determine whether my site is affected?
Check whether WP E-Signature Electronic Signature Add-on for Fluent Forms is installed and whether its version is 2.0.5 or earlier. The provided data does not include detection indicators or specific vulnerable endpoints.