The plugin has a missing authorization flaw that permits attackers to invoke protected actions without proper authentication. With this weakness an unauthorized user can reach endpoints that are engineered for authorized administrators, potentially altering SMS notification settings, disabling warnings, or sending messages on behalf of the site. The effect is an elevation of privilege within the WordPress environment, allowing exploitation of the plugin’s functionality.

The vulnerability is present in the WordPress plugin "SMS Contact Form 7 Notifications by ClickSend" by the vendor clicksend. It affects all released versions from the earliest version up to and including 1.4.0. Attackers should verify whether they are using a version that is still vulnerable and evaluate the risk to their WordPress installations.

The CVSS score is 4.3, indicating low to moderate impact. The EPSS score of less than 1% shows that the probability of an active exploit is low. The vulnerability is not listed in the CISA KEV catalog, implying no current evidence of widespread exploitation. The likely attack path is remote, via HTTP requests to the plugin’s REST or admin endpoints that are not properly guarded. Attacker prerequisites are minimal – the ability to send an HTTP request to the target WordPress site is sufficient to test for the flaw.