The vulnerability allows an attacker to forge a request that is accepted by the WordPress Builder for Contact Form 7 plugin as if it came from an authenticated user. By manipulating the form submission or administrative actions, an attacker can alter form data, change site settings, or inject malicious payloads that will be processed without the victim's explicit intent. This can compromise the integrity of user input handling and potentially lead to undesired data processing or storage.

PlanetStudio’s Builder for Contact Form 7 by Webconstruct is affected when deployed on WordPress. The issue applies from an unspecified earlier version through to version 1.2.2 inclusive. Any site running any of those versions of the plugin is potentially vulnerable.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation would likely require a user to be authenticated or a form to be submitted by a logged‑in administrator, so the attack vector is inferred to be target‑specific. Due to the modest scoring and lack of known exploits, the risk is considered moderate but should still be addressed promptly.