This question already has an answer here:
- Cycle attack on RSA 2 answers
It is know that elements from $[1..N-1]$, where $N$ is RSA modulus can have different orders. So some of the elements can have very small order generating subgroup of only few elements.
Now, if the adversary for a message chooses $m$ that has small order, the adversary does not have to know the private exponent $d$ to forge the signature for this $m$, since the same signature can be produced using smaller exponent $x$ $(d \equiv x \mod ord(m))$, which can be found easier than the private exponent $d$.
Why is this not a concern in RSA signature scheme?
Update: The cyclic attack does not depend on the order of $m$. The answer should be related to the distribution of orders for elements in $[1..N-1]$. Since the order of element divides $\phi(n)$, the choice of $p$ and $q$ should have some effect on the feasibility of this attack.