The vulnerability is an Insecure Direct Object Reference that allows unauthenticated users to request the identifier of any contract stored by the Formidable Forms Signature Online Contract Automation plugin and obtain its contents. Because the plugin does not enforce an authentication check before serving contract data, an attacker can read confidential contract documents. The weakness is classified as CWE-639 and results in a confidentiality breach of potentially sensitive business or personal information.

The flaw exists in the WordPress plugin Formidable Forms Signature Online Contract Automation, version 2.0.1 and earlier, published by approveme. All WordPress sites that deploy these versions of the plugin for contract automation are affected.

The CVSS score of 7.5 indicates a moderate to high risk. No EPSS score is available for this vulnerability, and it is not listed in the CISA KEV catalog, so the exploitation likelihood is unclear but not negligible. The attack vector is inferred to be a simple URL manipulation or API request that includes the contract identifier, as the plugin relies on the provided ID to retrieve the document without additional verification. Because authentication is not required, an attacker only needs to know or guess a valid contract ID to read the data, making the exploit straightforward once the target site hosts the vulnerable plugin.