Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms… (CVE-2026-110383)

CVE-2026-110383 describes an authorization bypass vulnerability in the WP E-Signature Electronic Signature Add-on for Fluent Forms (signature-fluent-contract-forms-add-on). The vulnerability arises from incorrectly configured access control security levels that can be exploited by an attacker controlling a key parameter. This allows unauthorized access to sensitive data or functionality. The affected versions include all versions through 2.0.5. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with a high impact on confidentiality. No known exploits are reported in the wild, and no vendor advisory or patch information is provided.

Successful exploitation results in unauthorized access to sensitive information due to bypassing authorization controls. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected add-on and monitor for suspicious activity related to authorization bypass attempts.