A missing authorization flaw in the Contact Form 7 AWeber Extension plugin allows attackers to perform unauthorized actions. The vulnerability is described as broken access control, permitting exploitation of incorrectly configured security levels. An attacker can create or modify data, potentially gaining elevated privileges or performing unauthorized actions. The weakness is identified as CWE-862, and the CVSS score of 5.3 indicates moderate impact.

The plugin, developed by Renzo Johnson and named Contact Form 7 AWeber Extension, is affected in all releases from an unspecified baseline up to and including version 0.1.40. The plugin’s insecure access control is present in any WordPress installation that has this plugin installed before this version. Administrators should review all WordPress sites that use this plugin version.

The vulnerability’s moderate CVSS score combined with a very low EPSS (<1%) suggests that exploitation is less likely but still feasible, especially on actively maintained sites with the plugin. Since the vulnerability is not in the CISA KEV catalog, there is no evidence of widespread active exploitation. Attackers would likely need initial access to the WordPress admin interface or a user account with capabilities that the plugin permits; the flaw permits bypassing intended access restrictions.