This vulnerability (CVE-2026-65523) affects Formidable Forms Signature Online Contract Automation versions <= 2.0.1. It is an unauthenticated IDOR issue where attackers can bypass authorization by exploiting user-controlled keys, potentially accessing sensitive information without proper permissions. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official remediation or patch information is currently available.

An attacker can exploit this vulnerability remotely without authentication to access sensitive data that should be protected by authorization controls. The confidentiality of data is at high risk, but integrity and availability are not affected. This could lead to unauthorized disclosure of contract or signature information managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual access patterns. Avoid exposing the plugin to untrusted networks where possible.