The Doppler Forms plugin for WordPress contains a missing authorization check that allows an attacker to bypass configured access control levels. This flaw enables unauthorized users to perform actions or access data normally protected for higher‑privilege roles, potentially compromising the confidentiality and integrity of the form submissions and providing a foothold for further exploitation on the site. The weakness is identified as CWE‑862, an authorization failure within the application logic.

The vulnerability affects all installations of the Doppler Forms plugin released by fromdoppler with a version number of 2.4.6 or earlier. Any WordPress site that has an unpatched instance of this plugin is considered vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% reflects a low current exploitation probability. The issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a web request to the plugin’s endpoints where an unauthenticated or low‑privilege user can trigger privileged actions. Exploitation would require the plugin to be active and accessible, but no additional network conditions are specified.