The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress contains an improper authentication vulnerability (CWE-287) in its signature functionality. This flaw allows unauthenticated attackers to extract sensitive information, specifically user signatures, from affected versions up to 1.15.22. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been documented in the provided data.

The vulnerability enables unauthorized disclosure of sensitive user data (signatures) without requiring authentication. This exposure could lead to privacy violations or misuse of personal information. There is no indication of impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected plugin or disabling the signature functionality if possible. Monitoring official 10Web communications for updates is recommended.