What is the CVSS score of CVE-2026-65523?

CVE-2026-65523 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Formidable Forms Signature are affected by CVE-2026-65523?

The Formidable Forms Signature Online Contract Automation WordPress plugin (versions ≤2.0.1) contains an unauthenticated vulnerability allowing unrestricted access to stored contract documents and…

How to fix or mitigate CVE-2026-65523?

Within 24 hours, immediately deactivate the Formidable Forms Signature Online Contract Automation plugin on all WordPress installations and audit access logs for unauthorized document queries. Within 7 days, inventory all contracts and signatures processed through the plugin, assess exposure scope, and notify affected parties if sensitive agreements were potentially compromised. Within 30 days, migrate to an alternative contract management platform with enforced role-based access controls, implement a WordPress-focused WAF to block object-reference enumeration patterns, and establish monitoring rules for suspicious IDOR-consistent access attempts.

Formidable Forms Signature CVE-2026-65523

EUVD-2026-53970 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-06 Patchstack

GHSA-qmmh-wqwc-q978

WordPress Authentication Bypass Wordpress Plugin Formidable Forms Signature Online Contract Automation

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated IDOR with read-only impact; no write or availability effect; low complexity as enumeration requires no special conditions.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:30 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

AnalysisAI

Unauthenticated IDOR in the Formidable Forms Signature Online Contract Automation WordPress plugin (≤2.0.1) exposes contract documents and signature records to any remote, unauthenticated attacker who can enumerate object reference identifiers. The CVSS 7.5 (High) rating reflects network-accessible exploitation with no authentication, no user interaction, and high confidentiality impact - consistent with unrestricted read access to potentially sensitive legal and personal contract data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this trivially scriptable.

Technical ContextAI

The flaw is classified as CWE-639 (Authorization Through User-Controlled Key), a specific IDOR subtype where application logic uses a user-supplied identifier - typically a predictable numeric or sequential contract/document ID - to retrieve a backend object without verifying whether the requesting party is authorized to access it. The affected product, developed by ApprovMe, is a WordPress plugin that extends Formidable Forms to handle online contract signing workflows, storing signature data and contract documents. CPE: cpe:2.3:a:approveme:formidable_forms_signature_online_contract_automation:*:*:*:*:*:*:*:* confirms all versions through 2.0.1 are affected. The root cause is missing or bypassed authorization checks on object retrieval endpoints, not a cryptographic or injection flaw.

RemediationAI

Update the Formidable Forms Signature Online Contract Automation plugin to a version above 2.0.1 if a patched release has been published. Check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/forms-signature-formidable-online-contract-automation/vulnerability/wordpress-formidable-forms-signature-online-contract-automation-plugin-2-0-1-insecure-direct-object-references-idor-vulnerability and the WordPress plugin repository for the confirmed patched version - no specific fix version number is independently confirmed in the available data. If no update is immediately available, disable the plugin to eliminate the attack surface at the cost of losing contract signing functionality. As a partial compensating control, restrict the plugin's contract retrieval endpoints via WAF rules or server-level IP allowlisting to authenticated or trusted IP ranges only, though this adds operational overhead and may break legitimate use cases. Avoid leaving the plugin active and publicly accessible without access controls if sensitive contract data is stored.