{"id":"CVE-2026-110383","kind":"vulnerability","aliases":["CVE-2026-110383"],"related":[],"title":"WP E-Signature Fluent Forms add-on: authorization bypass through user-controlled key","description":"Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5.","summary":"The WP E-Signature Electronic Signature Add-on for Fluent Forms, a WordPress plugin, has an authorization bypass where a user-controlled key lets a request skip access checks. An attacker may be able to reach signature or contract data they should not see.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-signature","fluent-forms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Electronic Signature Add-on for Fluent Forms (plugin slug `signature-fluent-contract-forms-add-on`) in the WordPress plugins screen or `wp plugin get signature-fluent-contract-forms-add-on --field=version`\n- unknown for other checks: the sources do not say which endpoints or settings are involved","fix":"- Update the Electronic Signature Add-on for Fluent Forms plugin to a version later than `2.0.5`, if the vendor has released one\n- unknown: the sources do not name a fixed version","status":"open","published_at":"2026-10-18T11:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:23:34+00:00","updated_at":"2026-10-25T03:23:34+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:23:34Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Electronic Signature Add-on for Fluent Forms plugin to a version later than `2.0.5`, if the vendor has released one\n- unknown: the sources do not name a fixed version","reach":"internet","title":"WP E-Signature Fluent Forms add-on: authorization bypass through user-controlled key","impact":"medium","summary":"The WP E-Signature Electronic Signature Add-on for Fluent Forms, a WordPress plugin, has an authorization bypass where a user-controlled key lets a request skip access checks. An attacker may be able to reach signature or contract data they should not see.","category":"package","nicknames":[],"who_cares":["wordpress","fluent-forms","e-signature","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized access to signed contracts and form data","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and the exact access control setting involved.","how_to_check":"- Check the installed version of the Electronic Signature Add-on for Fluent Forms (plugin slug `signature-fluent-contract-forms-add-on`) in the WordPress plugins screen or `wp plugin get signature-fluent-contract-forms-add-on --field=version`\n- unknown for other checks: the sources do not say which endpoints or settings are involved","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Electronic Signature Add-on for Fluent Forms at version `2.0.5` or earlier, which is a WordPress plugin that adds signing to Fluent Forms. The description refers to incorrectly configured access control levels, so exposure likely depends on how the add-on's access settings are configured, which the sources do not detail. Sites that do not use this add-on can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":3352,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110383':19A,22A '-2026':18A,21A '2.0.5':130C 'abl':70B 'access':64B,113C 'add':8A,42B,97C,107C,122C 'add-on':7A,41B,96C,121C 'affect':118C 'allow':109C 'attack':67B 'author':10A,52B,81C 'bypass':11A,53B,82C 'check':65B 'configur':112C 'contract':75B,105C 'control':15A,58B,86C,114C 'cve':17A,20A 'data':76B 'e':3A,24B,37B,92C 'e-signatur':2A,23B,36B,91C 'electron':39B,94C,119C 'exploit':110C 'fluent':5A,27B,45B,100C,104C,125C 'fluent-form':26B 'form':6A,28B,46B,101C,106C,126C 'host':32B 'incorrect':111C 'issu':117C 'key':16A,59B,87C 'let':60B 'levels.this':116C 'may':68B 'n/a':128C 'packag':29B 'plugin':49B 'reach':72B 'request':62B 'secur':115C 'see':80B 'self':31B 'self-host':30B 'signatur':4A,25B,38B,40B,73B,93C,95C,103C,120C 'signature-fluent-contract-forms-add-on':102C 'skip':63B 'user':14A,57B,85C 'user-control':13A,56B,84C 'vulner':88C 'wordpress':33B,48B 'wp':1A,35B,90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Electronic Signature Add-on for Fluent Forms at version `2.0.5` or earlier, which is a WordPress plugin that adds signing to Fluent Forms. The description refers to incorrectly configured access control levels, so exposure likely depends on how the add-on's access settings are configured, which the sources do not detail. Sites that do not use this add-on can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110383","severity":null,"published_at":"2026-10-18T11:16:36+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}