The vulnerability identified as CVE-2026-24985 affects the approveme WP Forms Signature Contract Add-On (versions up to 1.8.2). It is characterized by missing authorization checks, which means that users with limited privileges (PR:L) can exploit incorrectly configured access control to perform unauthorized actions. The CVSS vector indicates network attack vector (AV:N), low attack complexity (AC:L), no user interaction required (UI:N), unchanged scope (S:U), no confidentiality or availability impact (C:N, A:N), but with integrity impact (I:L). There is no vendor advisory or patch information available at this time.

The impact of this vulnerability is limited to integrity, meaning unauthorized users may be able to modify data or perform actions they should not be allowed to. There is no impact on confidentiality or availability. The vulnerability requires network access and low complexity to exploit but does require some level of privileges (low privileges). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected add-on to trusted users only and monitor for unusual activity related to the WP Forms Signature Contract Add-On. Avoid granting unnecessary privileges to users who can interact with this add-on.