BuddyForms for WordPress contains a missing authorization flaw (CWE-862) that permits users to invoke functions that are not properly constrained by access control lists. The Mekraft BuddyForms plugin’s vulnerability spans all releases up to version 2.10.2, allowing any user with authentication to access capabilities that should be restricted to higher‑privilege accounts. The description does not specify the exact privilege level required to exploit the flaw; it is inferred that authentication is likely necessary, as is typical for missing authorization vulnerabilities.

WordPress sites that run any version of the Themekraft BuddyForms plugin from the initial release through 2.10.2 are affected. Those older releases lack proper ACL checks, enabling any authenticated user to trigger restricted operations. Sites that have upgraded beyond 2.10.2 are not vulnerable.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of < 1% shows a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. This is a missing authorization issue, so it is likely that the attacker needs some level of authentication to exploit the flaw, but the description does not specify the required privilege level; this inference is based on common patterns for such vulnerabilities.