The vulnerability resides in a missing capability check on the MagicForm plugin’s AJAX actions. An authenticated user with Subscriber level or higher can therefore invoke these endpoints to delete or view logs, modify form definitions, or change plugin settings, effectively allowing them to alter data they should not be able to access.

The flaw affects all releases of the MagicForm WordPress plugin up to and including version 1.6.2, which is distributed by the developer dcooperman. Any WordPress site running one of these versions is susceptible.

With a CVSS score of 6.3 the issue is considered moderate in severity. The EPSS score is below 1%, indicating that exploitation is unlikely in the wild, and it has not been noted in CISA’s KEV catalog. The attack requires an authenticated account with at least Subscriber privileges; the perpetrator can trigger the vulnerable AJAX endpoint via an HTTP request, making the flaw straightforward to abuse once credentials are in hand.