A missing authorization flaw allows users to exploit incorrectly configured access control levels in the CubeWP Forms plugin, enabling them to view or utilize data and functions that should be restricted. The vulnerability can compromise confidentiality and integrity of form data and potentially expose sensitive information, but it does not provide code execution or denial of service. The weakness is a classic Broken Access Control fault as identified by CWE‑862.

The issue affects WordPress installations running versions of the CubeWP Forms plugin up to and including 1.1.5. Users of the plugin should verify the exact installed version; any instance that matches 1.1.5 or earlier is considered vulnerable.

The CVSS score of 4.3 indicates medium risk; the EPSS score of less than 1% suggests a very low likelihood of automated exploitation at present. The vulnerability is not listed in CISA KEV, so no confirmed production exploitation is known. The attack likely proceeds via crafted HTTP requests to privileged plugin endpoints, taking advantage of the lack of proper authorization checks. Broad network exposure is possible if the WordPress site is publicly reachable, but an attacker would still need to identify the vulnerable endpoints.