CVE-2026-110383: Authorization Bypass Through User-Controlled Key in WP E-Signature Electronic Signature Add-on for Fluent Forms

The WP E-Signature Electronic Signature Add-on for Fluent Forms contains an authorization bypass vulnerability identified as CVE-2026-110383. The flaw arises from incorrectly configured access control security levels, allowing an attacker to bypass authorization checks through manipulation of a user-controlled key. This affects all versions from initial release through 2.0.5. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, reflecting a network attack vector, low attack complexity, no privileges or user interaction required, and a significant confidentiality impact. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authorization controls and gain unauthorized access to sensitive information within the affected plugin. The impact is limited to confidentiality loss; integrity and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to authorization bypass attempts.