A missing authorization flaw in the VPSUForm plugin allows an attacker to exploit incorrectly configured access control levels. The vulnerability is a classic Broken Access Control (CWE-862) and can lead to unauthorized access to the plugin’s data or configuration, potentially exposing sensitive information or allowing unauthorized modifications.

The Vikas Ratudi VPSUForm plugin is affected through version 3.2.20 and earlier versions listed as n/a in the vendor disclosure. Any installation of VPSUForm at or below 3.2.20 should be considered vulnerable until a newer release is installed.

The CVSS score of 4.3 represents a moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The workaround involves correctly configuring or disabling access control settings. Although not listed in CISA’s KEV catalog, the vulnerability could be exploited by a user who can discover or guess URLs or endpoints exposed by the plugin. A successful attack would give the user higher permissions than intended, but it would not provide remote code execution or system compromise beyond the plugin’s scope.