This vulnerability is caused by a missing capability check in the get_config function of the WS Form LITE plugin for WordPress. Because the check is omitted, any user can request the function and read the plugin’s configuration, including API keys for integrated services. This flaw leads to a confidentiality breach where attackers can obtain sensitive credentials that may enable impersonation of services or further exploitation.

The affected product is the WS Form LITE – Drag & Drop Contact Form Builder for WordPress provided by Westguard. All releases up to and including version 1.10.35 contain this issue; no later releases are listed as affected. If your site uses any of these versions, it is vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS is less than 1%, suggesting a low probability of exploitation, and the vulnerability is not included in the CISA KEV catalog. An attacker can exploit the flaw by invoking the get_config function without authentication. The likely attack vector is an unauthenticated HTTP request to the get_config endpoint, based on the description that the check is missing.