The vulnerability is a missing authorization flaw (CWE-862) that lets an attacker bypass configured access control constraints within the SzMake Contact Form 7 Anti Spambot plugin. Because the plugin fails to enforce proper privileges, an attacker can invoke restricted contact form features or spam‑mitigation controls that are intended for authorized users only, potentially enabling abuse through the site’s contact forms.

The vulnerability affects the SzMake Contact Form 7 Anti Spambot WordPress plugin, versions from the earliest available through 1.0.1 inclusive. Users running any of these plugin versions on any WordPress installation are at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % points to a very low probability that the flaw has been exploited in the wild. The issue is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via the WordPress web interface, exploiting the plugin’s lack of authorization checks. Whether an attacker can achieve significant damage depends on the scope of the plugin’s functions, which the CVE does not detail.