Missing authorization in the WAH Forms plugin allows an attacker to request plugin endpoints without proper authentication, leading to the exposure of sensitive user data. The vulnerability is classified as an access control weakness, as defined by CWE-862, and can result in confidentiality violations where confidential information becomes readable by unauthorized parties.

The vulnerability affects the WordPress WAH Forms plugin from its earliest released versions through 1.0, including all installations of the plugin regardless of WordPress core version. Users running any supported variant of WAH Forms up to and including version 1.0 are potentially impacted.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the missing authorization flaw can be triggered over the network by sending crafted requests to the plugin's endpoints. Because the flaw permits unauthenticated data exposure, attackers could potentially gather sensitive content without needing credentials.