The Integrate Contact Form 7 and AWeber plugin contains an AJAX endpoint that resets AWeber logs without verifying the user's role. Because the check is missing, any authenticated user with Subscriber level or higher can trigger a log reset. This lack of authorization (CWE-862) can allow attackers to tamper with integration data and potentially disrupt service availability for the affected WordPress site.

WordPress sites running the plugin Integrate Contact Form 7 and AWeber version 0.1.42 or earlier. The plugin is distributed by rnzo.

The CVSS score of 4.3 reflects a medium risk, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability requires legitimate authentication and a role of Subscriber or higher, limiting lateral movement to users with those privileges. The plugin is not included in the CISA KEV list, so there is no evidence of widespread exploitation. Nonetheless, site administrators who have many subscriber accounts should consider the potential for internal misuse.