{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awp_e-signatureelectronic_signature_add-on_for_fluent_forms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp_e-signature:electronic_signature_add-on_for_fluent_forms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110383"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Electronic Signature Add-on for Fluent Forms (\u003c= 2.0.5)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","authorization-bypass","wordpress","cve"],"_cs_type":"advisory","_cs_vendors":["WP E-Signature"],"content_html":"\u003cp\u003eThe Electronic Signature Add-on for Fluent Forms (WP E-Signature) contains an authorization bypass vulnerability identified as CVE-2026-110383. The flaw exists in versions 2.0.5 and below. It arises from the improper validation or handling of user-controlled keys, which allows an unauthenticated or low-privileged actor to manipulate access control security levels. By exploiting this mechanism, an attacker can bypass intended permission checks, potentially gaining unauthorized administrative access or modifying signature workflows within the plugin context. Given the nature of the application, this could lead to the exposure of sensitive documents or the modification of legal agreements managed by the plugin. Defenders should prioritize updating to the latest secure version of the plugin as soon as it is available from the vendor.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to administrative functions and potential modification of legal signature processes. This poses a significant risk to the integrity of contracts and documents stored or managed via the Electronic Signature Add-on for Fluent Forms. The vulnerability is rated with a CVSS v3.1 base score of 7.5, indicating a high risk to availability and confidentiality of the targeted WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Electronic Signature Add-on for Fluent Forms to a version patched against CVE-2026-110383 (version 2.0.6 or later).\u003c/li\u003e\n\u003cli\u003eReview administrative access logs for the WordPress site to identify unauthorized modifications to plugin configuration settings.\u003c/li\u003e\n\u003cli\u003eRestrict administrative access to the WordPress dashboard to known, secure IP ranges to mitigate the impact of authorization bypass attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T11:57:45Z","date_published":"2026-10-18T11:57:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-esignature-auth-bypass/","summary":"CVE-2026-110383 is an authorization bypass vulnerability in the Electronic Signature Add-on for Fluent Forms that permits attackers to manipulate access control levels due to improper user-controlled key handling.","title":"Authorization Bypass in Electronic Signature Add-on for Fluent Forms","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-esignature-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wp_e-Signature:electronic_signature_add-On_for_fluent_forms:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}