CVE-2026-65523 HIGH

CVE-2026-65523: WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Vendor Approveme
Product Formidable Forms Signature Online Contract Automation
Weakness CWE-639 · IDOR
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Formidable Forms Signature Online Contract Automation versions up to 2.0.1 contain an authorization bypass vulnerability. An attacker can read sensitive contract and signature data by manipulating user-controlled identifiers without authentication. The vulnerability affects the core contract retrieval mechanism and exposes confidential information to unauthorized parties.

What an attacker can do

03Attacker Capabilities

Read contract and signature data belonging to other users without logging in.

Potential impact on your site

04Site Impact

Confidential contracts and digital signatures may be exposed to unauthorized parties.

Conditions required to exploit

05Prerequisites

Network access to the application; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-13464 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CVE-2026-3688 WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation CVE-2026-39518 WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-57676 WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability