Ninja Forms Signature Contract Add On
Monthly
Missing authorization controls in the WP E-Signature 'Ninja Forms Signature Contract Add-On' for WordPress (all versions from the initial release through 3.2.5) let remote, unauthenticated attackers reach a function that should be restricted and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) confirms no credentials, no user interaction, and no special configuration are required against a default installation, but impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code was identified at time of analysis and no EPSS or CISA KEV data was provided, so there is no confirmed active exploitation; risk is driven by the plugin's narrow deployment footprint and the low-sensitivity, read-only nature of the exposure.
Missing authorization controls in the WP E-Signature 'Ninja Forms Signature Contract Add-On' for WordPress (all versions from the initial release through 3.2.5) let remote, unauthenticated attackers reach a function that should be restricted and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) confirms no credentials, no user interaction, and no special configuration are required against a default installation, but impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code was identified at time of analysis and no EPSS or CISA KEV data was provided, so there is no confirmed active exploitation; risk is driven by the plugin's narrow deployment footprint and the low-sensitivity, read-only nature of the exposure.