A missing authorization check in the Rohil Contact Form – 7 : Hide Success Message WordPress plugin allows an attacker to access functions that should be protected. The vulnerability is a classic broken access control flaw (CWE‑862). Through this loophole, an unauthorized user could invoke privileged operations, potentially exposing or manipulating plugin data and affecting the confidentiality, integrity, and availability of the site’s form handling capabilities.

The vulnerability impacts the Contact Form – 7 : Hide Success Message plugin from its initial release through version 1.1.4. Any WordPress installation using one of these versions is at risk, regardless of the host operating system or WordPress core version.

The patch has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting very low current exploitation likelihood. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack surface is likely local or authenticated, requiring the attacker to reach a form of privileged access or to trick a legitimate user into granting the necessary permissions. Because the flaw is a simple missing ACL, once the correct capability is granted it can be abused without further exploitation steps.