The vulnerability in the mmattax Formstack Online Forms WordPress plugin is a missing authorization check that permits users without proper privileges to view or manipulate forms that are meant to be restricted. By exploiting this flaw, an attacker could potentially read sensitive data or alter form configurations, thereby compromising confidentiality and integrity of the site’s data.

Systems running mmattax Formstack Online Forms version 2.0.2 or older are susceptible, as the flaw was present through all releases up to and including 2.0.2. Administrators should verify whether their installation falls within this version range.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not recorded in CISA’s KEV catalog, and no public exploit has been reported. Likely attack paths involve sending crafted requests to unprotected form endpoints or using exposed administrative URLs that bypass role checks, especially on sites where access control is incorrectly configured.