Ninja Forms Signature CVE-2026-110378

Exploitation requires that the target WordPress site has the WP E-Signature Ninja Forms Signature Contract Add-On installed and active at version 3.2.5 or earlier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are needed - a remote attacker can reach the vulnerable, improperly access-controlled function over the network against a default installation. The primary limiting factors are the plugin's narrow deployment footprint and the confidentiality-only impact (C:L, I:N, A:N): successful exploitation discloses restricted data but does not permit data modification or service disruption. The exact protected endpoint/feature affected is not specified in the available description.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the WP E-Signature 'Ninja Forms Signature Contract Add-On', scored CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) by the reporter Patchstack. The vector indicates remote, network-based, low-complexity exploitation requiring no privileges and no user interaction, but the impact is limited to a low confidentiality breach only (I:N/A:N) - meaning an attacker can likely read or access data they should not, but cannot modify data or affect availability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; the risk is driven entirely by the CVSS vector rather than any exploitation evidence. The signals are internally consistent (no conflicts between vector and description), but the real-world priority is tempered by the narrow, confidentiality-only impact and the niche nature of the affected plugin. Treat this as a routine patch-management item rather than an emergency - meaningfully lower urgency than its 'medium' CVSS alone might imply, absent any exploitation indicators.

A remote, unauthenticated attacker sends a crafted HTTP request directly to an access-control-protected function or endpoint of the Ninja Forms Signature Contract Add-On (version ≤ 3.2.5) that fails to verify authorization. Because the check is missing, the attacker gains read access to data intended to be restricted, such as signature or contract-related information. No public exploit code was identified at time of analysis, and the impact is limited to confidentiality disclosure.