The Vulnerability is an Insecure Direct Object Reference that allows a user to trigger the plugin to return a signature record that they are not authorized to view or modify. Because the access control checks rely on a user‑controlled key, an attacker could request or alter any signature file, compromising the confidentiality and integrity of signed documents and potentially allowing the creation or tampering of legal agreements.

This issue is present in the WordPress Electronic Signature Add‑on for Fluent Forms, specifically in all releases up to and including version 2.0.5. The affected product is the WordPress plugin that provides electronic signature functionality for Fluent Forms.

The CVSS score of 7.5 indicates a high severity vulnerability. The absence of an EPSS score suggests limited public exploitation data, while the vulnerability is not listed in the CISA KEV catalog. The likely attack path is local or remote to a WordPress site that hosts the plugin; an attacker who can guess or brute‑force the signature identifier can bypass access controls and retrieve or modify protected documents. This could result in significant business or legal impact if not addressed promptly.