FORMS-SIGNATURE-FORMIDABLE-ONLINE-CONTRACT-AUTOMATION · CVE-2026-121722 · Package
FIX → 2.0.6
WP E-Signature for Formidable Forms is a WordPress plugin for online contract signing. A missing authorization check lets users reach functions their role should not allow.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the WP E-Signature for Formidable Forms plugin at version 2.0.5 or earlier are in the affected range, according to NVD. The sources do not say which functions need an account or which roles are needed to reach them, so the exact exposure is unknown.
Not affected if plugin-not-installed
Who cares formidable-forms, wordpress, wp-e-signature
Upgrade to 2.0.6
2.0.6 or later (current release on WordPress.org)2.0.6 changelog only says and does not name this CVE, so the link between and this CVE is inferred from NVDthrough 2.0.5'Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract Automation: from n/a through 2.0.5.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
SECURITY: Fixed a security issue2.0.6s