A missing authorization flaw in Shahjada Live Forms allows an attacker to modify plugin settings without proper access control. This defect stems from incorrectly configured security levels that fail to enforce role‑based restrictions, enabling unauthorized changes to how forms behave or what data is collected. The impact is a change in configuration, which could alter data handling or expose sensitive information.

WordPress sites running Shahjada Live Forms version 4.8.4 or earlier are affected, from the plugin’s initial release up to and including 4.8.4. Sites must verify the installed version and consider the plugin unavailable until a newer release is applied.

The CVSS score of 5.4 classifies the vulnerability as moderate, while the EPSS score of <1% indicates a very low likelihood of current exploitation. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires an authenticated user on the site, or a user with privileged access to the plugin’s settings, since the lack of authorization checks allows such users to change configuration.