Formidable Forms Signature Online Contract Automation
Monthly
Unauthenticated IDOR in the Formidable Forms Signature Online Contract Automation WordPress plugin (≤2.0.1) exposes contract documents and signature records to any remote, unauthenticated attacker who can enumerate object reference identifiers. The CVSS 7.5 (High) rating reflects network-accessible exploitation with no authentication, no user interaction, and high confidentiality impact - consistent with unrestricted read access to potentially sensitive legal and personal contract data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this trivially scriptable.
Unauthenticated IDOR in the Formidable Forms Signature Online Contract Automation WordPress plugin (≤2.0.1) exposes contract documents and signature records to any remote, unauthenticated attacker who can enumerate object reference identifiers. The CVSS 7.5 (High) rating reflects network-accessible exploitation with no authentication, no user interaction, and high confidentiality impact - consistent with unrestricted read access to potentially sensitive legal and personal contract data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this trivially scriptable.