The vulnerability is a missing authorization flaw in the Codexpert, Inc CF7 Submissions plugin. Incorrectly configured access control security levels allow an attacker to use plugin‑protected functions without proper authentication or privilege checks, potentially leading to unauthorized reading, creation, modification, or deletion of form submissions. The impact is primarily a grant of elevated privileges over sensitive plugin data and configuration.

The plugin is distributed by Codexpert, Inc and is vulnerable in all releases up to and including version 0.26. Any WordPress site running CF7 Submissions 0.26 or earlier is affected; newer releases beyond this version are not listed as affected.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to access the site’s front‑end or an authenticated user session to reach the exposed endpoints; however, the exact prerequisites are not detailed in the advisory.