{"id":"CVE-2026-121722","kind":"vulnerability","aliases":["CVE-2026-121722"],"related":[],"title":"WP E-Signature for Formidable Forms: missing authorization check exposes contract data","description":"Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract Automation: from n/a through 2.0.5.","summary":"WP E-Signature for Formidable Forms is a WordPress plugin for online contract signing. A missing authorization check lets users reach functions their role should not allow.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"forms-signature-formidable-online-contract-automation","fixed":["2.0.6"],"affected":"<= 2.0.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["formidable-forms","package","wordpress","wp-e-signature"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: find 'WP E-Signature for Formidable Forms' (slug forms-signature-formidable-online-contract-automation) and read the version.\n- Version 2.0.5 or earlier is in the NVD affected range; 2.0.6 is the latest release on WordPress.org.\n- With WP-CLI: wp plugin get forms-signature-formidable-online-contract-automation --field=version","fix":"Update the plugin to 2.0.6 or later (current release on WordPress.org). The 2.0.6 changelog only says 'SECURITY: Fixed a security issue' and does not name this CVE, so the link between 2.0.6 and this CVE is inferred from NVD's 'through 2.0.5'.","status":"open","published_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:28+00:00","updated_at":"2026-11-09T11:29:05+00:00","category":"package","confidence":0.55,"triage":{"at":"2026-11-09T11:26:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP E-Signature for Formidable Forms: missing authorization check exposes contract data","impact":"medium","summary":"WP E-Signature for Formidable Forms is a WordPress plugin for online contract signing. A missing authorization check lets users reach functions their role should not allow.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","formidable-forms","wp-e-signature"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted plugin functions on the site","analyst_note":"Check the WordPress plugin changelog or the Patchstack/Wordfence entry for the fixed version and the affected functions, since the NVD text only gives 'through 2.0.5'.","how_to_check":"- Check the installed version of the plugin `forms-signature-formidable-online-contract-automation` in the WordPress admin plugin list\n- Confirm whether the installed version is `2.0.5` or earlier","plain_action":"","product_name":"forms-signature-formidable-online-contract-automation","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP E-Signature for Formidable Forms plugin at version 2.0.5 or earlier are in the affected range, according to NVD. The sources do not say which functions need an account or which roles are needed to reach them, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4571,"output_tokens":566,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the WordPress plugin changelog or the Patchstack/Wordfence entry for the fixed version and the affected functions, since the NVD text only gives 'through 2.0.5'.","search":"'-121722':16A,19A '-2026':15A,18A '2.0.5':104C 'access':89C 'affect':94C 'allow':63B,85C 'author':9A,53B,65C 'autom':77C,84C,100C 'automation':26A 'check':10A,54B 'configur':88C 'contract':12A,25A,49B,76C,83C,99C 'control':90C 'cve':14A,17A 'data':13A 'e':3A,34B,38B,70C 'e-signatur':2A,37B,69C 'exploit':86C 'expos':11A 'form':7A,29B,42B,73C,79C,96C 'formid':6A,28B,41B,72C,81C,95C 'formidable':23A 'formidable-form':27B 'forms':21A 'forms-signature-formidable-online-contract-autom':78C 'forms-signature-formidable-online-contract-automation':20A 'function':58B 'incorrect':87C 'issu':93C 'let':55B 'levels.this':92C 'miss':8A,52B,64C 'n/a':102C 'onlin':48B,75C,82C,98C 'online':24A 'packag':30B 'plugin':46B 'reach':57B 'role':60B 'secur':91C 'sign':50B 'signatur':4A,35B,39B,71C,74C,80C,97C 'signature':22A 'user':56B 'vulner':66C 'wordpress':31B,45B 'wp':1A,33B,36B,68C 'wp-e-signatur':32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP E-Signature for Formidable Forms plugin at version 2.0.5 or earlier are in the affected range, according to NVD. The sources do not say which functions need an account or which roles are needed to reach them, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["formssignatureformidableonlinecontractautomation"],"ptokens":["automation","contract","formidable","forms","online","signature"],"labels":["formidableforms","high","package","vendor","wordpress","wpesignature"],"campaign_type":null,"search_a":"'-121722':16A,19A '-2026':15A,18A 'author':9A 'automation':26A 'check':10A 'contract':12A,25A 'cve':14A,17A 'data':13A 'e':3A 'e-signatur':2A 'expos':11A 'form':7A 'formid':6A 'formidable':23A 'forms':21A 'forms-signature-formidable-online-contract-automation':20A 'miss':8A 'online':24A 'signatur':4A 'signature':22A 'wp':1A","search_b":"'allow':63B 'author':53B 'check':54B 'contract':49B 'e':34B,38B 'e-signatur':37B 'form':29B,42B 'formid':28B,41B 'formidable-form':27B 'function':58B 'let':55B 'miss':52B 'onlin':48B 'packag':30B 'plugin':46B 'reach':57B 'role':60B 'sign':50B 'signatur':35B,39B 'user':56B 'wordpress':31B,45B 'wp':33B,36B 'wp-e-signatur':32B","search_c":"'2.0.5':104C 'access':89C 'affect':94C 'allow':85C 'author':65C 'autom':77C,84C,100C 'configur':88C 'contract':76C,83C,99C 'control':90C 'e':70C 'e-signatur':69C 'exploit':86C 'form':73C,79C,96C 'formid':72C,81C,95C 'forms-signature-formidable-online-contract-autom':78C 'incorrect':87C 'issu':93C 'levels.this':92C 'miss':64C 'n/a':102C 'onlin':75C,82C,98C 'secur':91C 'signatur':71C,74C,80C,97C 'vulner':66C 'wp':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121722","severity":null,"published_at":"2026-11-09T11:17:22+00:00","modified_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121722:2277","url":"https://wordpress.org/plugins/forms-signature-formidable-online-contract-automation/","severity":null,"published_at":"2026-11-09T11:29:05+00:00","modified_at":"2026-11-09T11:29:05+00:00","first_seen_at":"2026-11-09T11:29:05+00:00","fetched_at":"2026-11-09T11:29:05+00:00","note":"NVD/Patchstack CNA: missing authorization, through 2.0.5, CVSS 7.5 (AV:N/PR:N, confidentiality only). WordPress.org changelog shows 2.0.6 as latest with a generic security fix; affected functions not published. Patchstack page lists only an older IDOR (<=2.0.1), not this CVE. web-cli (Exa) had no credits; used WebFetch. X not checked. Nothing verified: the fix version is an inference.","cites":["https://wordpress.org/plugins/forms-signature-formidable-online-contract-automation/","https://patchstack.com/database/wordpress/plugin/forms-signature-formidable-online-contract-automation"]}],"documents":[{"id":107203,"url":"https://wordpress.org/plugins/forms-signature-formidable-online-contract-automation/","title":"WP E-Signature for Formidable Forms - WordPress.org plugin page (changelog)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":107204,"url":"https://patchstack.com/database/wordpress/plugin/forms-signature-formidable-online-contract-automation","title":"Patchstack: Formidable Forms Signature Online Contract Automation vulnerabilities","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}