The vulnerability is a missing authorization flaw that permits users without proper permissions to access and manage online contracts within the Formidable Forms Signature Online Contract Automation plugin. This can expose confidential contract information and allow unauthorized modifications, thereby compromising the confidentiality and integrity of contractual data.

WordPress sites running the WP E‑Signature Formidable Forms Signature Online Contract Automation plugin with versions up to and including 2.0.5 are affected. The vulnerability applies to all installations where the plugin’s default access control settings are in place.

Based on the description, the likely attack vector is via the plugin’s web interface or API endpoints that have not been properly protected. The CVSS score of 7.5 indicates high severity, and while the EPSS score is not available, the lack of a KEV listing does not diminish the potential impact. An attacker can exploit the broken access control by interacting with those endpoints, gaining unauthorized access to contract data without requiring elevated privileges.