The vulnerability is a missing authorization flaw in the WP E‑Signature Ninja Forms Signature Contract Add‑On plugin. Correctly configured access control levels are ignored, allowing an attacker to exercise functions or view data that should be restricted. By exploiting this weakness, an authenticated or unauthenticated user can gain additional rights, potentially accessing or tampering with signature contracts, which jeopardizes confidentiality and integrity of signed documents.

The issue affects the WordPress Ninja Forms Signature Contract Add‑On plugin from its earliest release through version 3.2.5. It is a WordPress plugin provided by WP E‑Signature and used to collect electronic signatures within the Ninja Forms framework. Any site running an affected version of this add‑on is vulnerable.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no active exploitation. The likely attack vector is remote, via the web interface of the plugin, and requires the attacker to be able to interact with the plugin’s administrative or user endpoints. The lack of a published exploit does not mitigate the need to remediate the broken access control before an exploit is discovered.