CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through <= 1.8.2.
Explanation of Vulnerability in Simple Terms
The WP Forms Signature Contract Add-On through version 1.8.2 does not properly check user permissions before allowing modifications to contract data. A logged-in user with low privileges can alter contract information they should not have access to. Update to a version newer than 1.8.2 to resolve this issue.
What an attacker can do
Modify contract data or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter contract terms, signatures, or metadata, potentially affecting legal agreements.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
