Live › vulnerability › CVE-2026-110383
Go to dashboardThe WP E-Signature Electronic Signature Add-on for Fluent Forms, a WordPress plugin, has an authorization bypass where a user-controlled key lets a request skip access checks. An attacker may be able to reach signature or contract data they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Electronic Signature Add-on for Fluent Forms at version or earlier, which is a WordPress plugin that adds signing to Fluent Forms. The description refers to incorrectly configured access control levels, so exposure likely depends on how the add-on's access settings are configured, which the sources do not detail. Sites that do not use this add-on can skip it.
2.0.5No product ranges from the sources yet.
signature-fluent-contract-forms-add-on) in the WordPress plugins screen or wp plugin get signature-fluent-contract-forms-add-on --field=version2.0.5, if the vendor has released oneEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-110383")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.