The vulnerability in the CF7 Spreadsheets WordPress plugin stems from a missing authorization check that allows an attacker to alter plugin configuration settings without proper permissions. By modifying these settings, the attacker can potentially change how form submissions are handled, redirect data, or tamper with spreadsheet output, thereby affecting data integrity and confidentiality. This weakness is categorized as an authorization failure (CWE‑862).

The issue impacts the CF7 Spreadsheets plugin from the earliest available version through version 2.3.2, as distributed by the vendor moshensky. Any WordPress installation that has this plugin installed in a version affected by the flaw is susceptible.

The CVSS score of 5.4 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The flaw is not listed as a known exploited vulnerability in the CISA KEV catalog. The attack vector is inferred to be local or web-based, requiring authenticated access to the WordPress site or exploitation of other compromised credentials to reach the plugin’s configuration interface. No public exploit has been reported, and the vulnerability appears to be a straightforward privilege escalation through misconfigured access control.