CVE-2026-65523 is an unauthenticated Insecure Direct Object Reference (IDOR) in a WordPress plugin that handles contract signatures. The vulnerability allows any anonymous attacker to access or modify contract data and signatures without any authentication token or user session. This isn't a failed authorization check — it's a complete absence of authentication context on the endpoint.
WordPress plugin developers frequently treat their REST endpoints as internal glue code, assuming that because the plugin runs within WordPress, callers must be authenticated. This is a structural misunderstanding: authentication is a precondition for authorization to function. If no user session exists, authorization checks never execute because the code path never reaches them. The developers likely tested authenticated workflows, confirmed authorization worked, and never asked what happens when a request arrives with no user context at all.
The domain matters here. This plugin processes legally binding documents. Even without confirmed exploitation, every contract signed through this tool while vulnerable was created under a false security assumption — the users trusted a system that was never as secure as they believed. That's epistemic harm that standard remediation frameworks don't address: you patch the endpoint and bump the version, but you have no protocol for telling signatories that the threat model was broken.
The fix requires more than adding a capability check. Audit every endpoint for proper authentication — not just authorization — and specifically test each one with no session cookies or Authorization header. The WordPress REST API permission callback return true; is a known anti-pattern that produces exactly this class of bug; treat any instance of it as a critical finding.
Be aware that the blast radius extends beyond your installation. The vulnerable code persists in abandoned plugin forks, unpatched sites, and version archives. Attackers can retrieve old versions and target organizations still running them. If your organization uses this plugin for contracts, the legal exposure from potentially forged or modified documents may persist regardless of whether you've patched.