Fluent Forms Signature EUVD-2026-103426

Requires that the target site has the Electronic Signature Add-on for Fluent Forms (signature-fluent-contract-forms-add-on) plugin installed and active at version 2.0.5 or earlier, alongside the Fluent Forms host plugin. Exploitation targets an endpoint that accepts a user-controlled object identifier (CWE-639) and fails to enforce per-object ownership/access control, letting an attacker substitute another user's ID to read their signature/contract records. Per the supplied vector (PR:N/UI:N) no authentication or user interaction is claimed to be required; however, because this is an IDOR of the kind that frequently requires at least a low-privilege account to reach the vulnerable endpoint, the unauthenticated assumption should be verified against the plugin's actual access model. Confidentiality impact only (C:H/I:N/A:N) - no modification or denial-of-service is indicated.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with an IDOR exposing other users' signed documents/contract data. However, the vector carries internal tension with the CWE: CWE-639 (Authorization Bypass Through User-Controlled Key) and the phrase 'Exploiting Incorrectly Configured Access Control Security Levels' typically imply the attacker must reach an object-referencing endpoint that is often gated behind at least low-privilege authentication, yet Patchstack scored PR:N - treat the unauthenticated assumption as vendor-asserted but not independently confirmed from the description. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active exploitation or weaponization. Net: this is a credible medium-to-high confidentiality risk for sites running the affected add-on, but it reads as a routine Patchstack-catalogued WordPress plugin IDOR rather than an urgent, broadly-exploited emergency - prioritize patching where the plugin is deployed, but it is not a drop-everything issue absent exploitation signals.

A remote attacker iterates or manipulates a user-controlled object identifier (e.g., a signature/document/form submission ID) in a request to the Electronic Signature Add-on for Fluent Forms, and the plugin returns records belonging to other users without verifying ownership. Because the supplied CVSS vector is AV:N/AC:L/PR:N/UI:N, the request can be sent over the network at low complexity with no user interaction. No public proof-of-concept was identified at time of analysis.