The vulnerability is a missing authorization flaw that allows users to access functionality not constrained by access control lists. An attacker could retrieve or manipulate lead form data, potentially exposing sensitive information or performing unwanted actions. The weakness is identified as CWE-862, which focuses on insufficient authorization checks.

Vendors affected include CridioStudio with the ListingPro Lead Form WordPress plugin. All installations using version 1.0.7 or earlier are vulnerable; the plugin version range is from the earliest release through 1.0.7.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability that the flaw is exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an authenticated user who is granted insufficient privileges; the attacker may bypass the ACL to execute restricted functions. No special environmental prerequisites are noted, so the flaw could be exploited where the plugin is active and accessible.