The vulnerability in the Live Forms plugin is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control levels. This flaw enables users who should not have elevated privileges to perform administrative actions on forms, including viewing, editing, or deleting form data. The weakness is classified as CWE‑862, indicating improper authorization controls.

Shahjada Live Forms plugin for WordPress is affected from the earliest releases through version 4.8.4, inclusive. All installations using these versions are vulnerable and may expose sensitive form data or administrative functionality.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, implying no known large‑scale exploitation yet. Attackers can potentially exploit the flaw remotely via the web interface, provided they can interact with a vulnerable WordPress site that hosts the affected plugin and that the site’s access control is not otherwise fortified.