CVE-2026-110378 MEDIUM

CVE-2026-110378: WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

Vendor Wp E-Signature
Product Ninja Forms Signature Contract Add-On
Weakness CWE-862 · Missing authorization
Published October 15, 2026
Last update October 19, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.

Key dates

02Disclosure timeline

October 15, 2026 CVE published
October 19, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-81761 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability CVE-2026-18347 Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action